4.3
Moyenne
CVE-2026-85641 The Formidable Forms WordPress plugin before 6.35 does not restrict who can set the identifier recording which user…
Description
The Formidable Forms WordPress plugin before 6.35 does not restrict who can set the identifier recording which user last edited a form entry, and relies on that identifier when deciding whether to strip HTML from stored entry values, allowing unauthenticated visitors to have markup rendered in the admin entry view that would otherwise be removed, and to attribute their submission to an administrator who never made it.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Formidable Forms 6.34 | 6.34 → < 6.35 | 6.35 |
Autres CVE de Formidable Forms
Les 8 CVE de Formidable Forms →
CVE-2026-85642
The Formidable Forms WordPress plugin before 7.0 does not verify the identity of the caller before recording the…
7.5
Élevée
CVE-2026-19857
The Formidable Forms WordPress plugin before 6.35 does not prevent a request-derived value from reaching the WordPress…
4.8
Moyenne
CVE-2026-11361
The Formidable Forms WordPress plugin before 6.32.1 does not properly validate the status of a PayPal subscription…
5.9
Moyenne
CVE-2024-9768
The Formidable Forms WordPress plugin before 6.14.1 does not sanitise and escape some of its settings, which could…
4.8
Moyenne