4.8
Moyenne
CVE-2026-19857 The Formidable Forms WordPress plugin before 6.35 does not prevent a request-derived value from reaching the WordPress…
Description
The Formidable Forms WordPress plugin before 6.35 does not prevent a request-derived value from reaching the WordPress shortcode parser when it substitutes a supported token into a form's custom HTML, allowing unauthenticated visitors to have arbitrary shortcodes, with attacker-chosen attributes, executed server-side on any page displaying an affected form.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Formidable Forms 6.34 | 6.34 → < 6.35 | 6.35 |
Références
- wpscan.com wpscan.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Formidable Forms
Les 8 CVE de Formidable Forms →
CVE-2026-85642
The Formidable Forms WordPress plugin before 7.0 does not verify the identity of the caller before recording the…
7.5
Élevée
CVE-2026-85641
The Formidable Forms WordPress plugin before 6.35 does not restrict who can set the identifier recording which user…
4.3
Moyenne
CVE-2026-11361
The Formidable Forms WordPress plugin before 6.32.1 does not properly validate the status of a PayPal subscription…
5.9
Moyenne
CVE-2024-9768
The Formidable Forms WordPress plugin before 6.14.1 does not sanitise and escape some of its settings, which could…
4.8
Moyenne