CVE-2026-18331
Deferred Deferred - Pending Action

Stored XSS in Formidable Forms WordPress Plugin

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: Wordfence

Description
The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'frm_user_id' parameter in all versions up to, and including, 6.33.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By forging frm_user_id to match an administrator's user ID — discoverable via the public WordPress REST API — an unauthenticated attacker causes wp_kses_post() to serve as the only output filter, which preserves the injected payload structurally intact; the plugin's admin JavaScript then decodes and executes it automatically on page load.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-26
Last Modified
2026-08-26
Generated
2026-08-26
AI Q&A
2026-08-26
EPSS Evaluated
N/A
NVD
CVE-2026-18331
EUVD
EUVD-2026-66294

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
formidable_forms formidable_forms to 6.33.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Formidable Forms WordPress plugin has a stored cross-site scripting (XSS) vulnerability in versions up to 6.33.1. Attackers can inject malicious scripts via the 'frm_user_id' parameter due to poor input sanitization and output escaping. These scripts execute when users visit infected pages.

Detection Guidance

Check if the Formidable Forms plugin version is up to 6.33.1 or lower. Use WordPress admin to inspect plugin versions or run SQL queries on the database for plugin metadata. Look for unusual script injections in form outputs or admin pages.

Impact Analysis

Unauthenticated attackers can steal user sessions, deface websites, or redirect visitors to malicious sites. They exploit the flaw by matching an admin's user ID via the WordPress REST API, causing scripts to execute automatically on page load.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality requirements. For HIPAA, it may compromise protected health information integrity, risking compliance violations.

Mitigation Strategies

Update the Formidable Forms plugin to the latest version immediately. Disable the plugin temporarily if an update is unavailable. Review and sanitize user inputs in forms. Monitor for suspicious admin activity or script injections.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18331. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart