4.8
Medium
CVE-2026-19857 The Formidable Forms WordPress plugin before 6.35 does not prevent a request-derived value from reaching the WordPress…
Description
The Formidable Forms WordPress plugin before 6.35 does not prevent a request-derived value from reaching the WordPress shortcode parser when it substitutes a supported token into a form's custom HTML, allowing unauthenticated visitors to have arbitrary shortcodes, with attacker-chosen attributes, executed server-side on any page displaying an affected form.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Formidable Forms 6.34 | 6.34 → < 6.35 | 6.35 |
Other CVEs of Formidable Forms
The 8 CVEs of Formidable Forms →
CVE-2026-85642
The Formidable Forms WordPress plugin before 7.0 does not verify the identity of the caller before recording the…
7.5
High
CVE-2026-85641
The Formidable Forms WordPress plugin before 6.35 does not restrict who can set the identifier recording which user…
4.3
Medium
CVE-2026-11361
The Formidable Forms WordPress plugin before 6.32.1 does not properly validate the status of a PayPal subscription…
5.9
Medium
CVE-2024-9768
The Formidable Forms WordPress plugin before 6.14.1 does not sanitise and escape some of its settings, which could…
4.8
Medium