Formidable Forms
Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:formidable_forms:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Formidable Forms (a50eea2c-e608-5091-9723-bf2e9ac7b1a7) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-85642 |
vulnerable | 2026-11-03 10:16:23.200733 |
Formidable Forms 6.5 - 6.35 - Unauthenticated Payment Gateway Connect Verification DoS
The Formidable Forms WordPress plugin before 7.0 does not verify the identity of the caller before recording the timestamp it uses to rate limit payment gateway verification requests, allowing unauthenticated attackers to consume the daily allowance and cause legitimate verification attempts to be refused for the next 24 hours.
Published: 2026-10-21T06:00:24.595Z
Updated: 2026-10-21T10:35:02.018Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-19857 |
vulnerable | 2026-10-13 12:30:00.907938 |
Formidable Forms < 6.35 - Unauthenticated Arbitrary Shortcode Execution via [entry_key] Custom HTML Token
MEDIUM (4.8)
The Formidable Forms WordPress plugin before 6.35 does not prevent a request-derived value from reaching the WordPress shortcode parser when it substitutes a supported token into a form's custom HTML, allowing unauthenticated visitors to have arbitrary shortcodes, with attacker-chosen attributes, executed server-side on any page displaying an affected form.
Published: 2026-09-16T06:30:05.888Z
Updated: 2026-09-16T17:40:30.151Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-85641 |
vulnerable | 2026-10-13 12:28:54.152041 |
Formidable Forms 6.34 - Unauthenticated Stored Content Injection via 'updated_by' Parameter
The Formidable Forms WordPress plugin before 6.35 does not restrict who can set the identifier recording which user last edited a form entry, and relies on that identifier when deciding whether to strip HTML from stored entry values, allowing unauthenticated visitors to have markup rendered in the admin entry view that would otherwise be removed, and to attribute their submission to an administrator who never made it.
Published: 2026-09-16T06:00:14.817Z
Updated: 2026-09-17T12:35:28.849Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-11361 |
vulnerable | 2026-09-16 04:32:46.350184 |
Formidable Forms < 6.32.1 - Unauthenticated Payment Bypass via PayPal APPROVAL_PENDING Subscription Status
MEDIUM (5.9)
The Formidable Forms WordPress plugin before 6.32.1 does not properly validate the status of a PayPal subscription payment before marking it complete, allowing unauthenticated users to bypass payment and trigger paid form actions — such as digital content access, license delivery, and membership activation — without being charged.
Published: 2026-08-06T16:45:22.234Z
Updated: 2026-08-07T13:45:09.753Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-9768 |
vulnerable | 2026-06-08 07:00:28.629253 |
Formidable Forms < 6.14.1 - Admin+ Stored XSS
The Formidable Forms WordPress plugin before 6.14.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Published: 2024-11-21T06:00:09.876Z
Updated: 2024-11-21T17:40:38.527Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-2877 |
vulnerable | 2026-06-08 06:02:43.583635 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-1405 |
vulnerable | 2026-06-08 05:52:35.782437 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-0816 |
vulnerable | 2026-06-08 05:52:32.884060 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.