CVE-2026-18331 in Formidable Forms Plugin
Summary
by MITRE • 08/26/2026
The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'frm_user_id' parameter in all versions up to, and including, 6.33.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By forging frm_user_id to match an administrator's user ID — discoverable via the public WordPress REST API — an unauthenticated attacker causes wp_kses_post() to serve as the only output filter, which preserves the injected payload structurally intact; the plugin's admin JavaScript then decodes and executes it automatically on page load.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified in Formidable Forms versions up to 6.33.1 represents a critical security flaw rooted in insufficient input sanitization and output escaping mechanisms within the WordPress ecosystem. This specific weakness allows for Stored Cross-Site Scripting, commonly referred to as XSS, which is classified under CWE-79 in the Common Weakness Enumeration standard. The core of the issue lies in how the plugin handles data associated with the frm_user_id parameter across various form submissions and administrative interfaces. Because the application fails to adequately sanitize user-supplied input before storage or properly escape it during output rendering, malicious actors can inject executable JavaScript code into the database that persists until manually removed by an administrator.
The operational impact of this vulnerability is severe due to its unauthenticated nature combined with a specific exploitation vector involving administrative privileges. An attacker does not need valid credentials to initiate the attack; they simply need to submit a form containing the malicious payload. The critical step in the exploit chain involves forging the frm_user_id parameter to match that of an administrator. This user ID is easily discoverable through the public WordPress REST API, which exposes user information by default unless explicitly restricted by other security measures or plugins. Once the attacker identifies a valid administrative user ID, they can craft requests that trick the system into associating their malicious input with that high-privilege account context.
When an administrator accesses pages containing this stored payload, the vulnerability manifests through a failure in output filtering logic. Specifically, the plugin relies on wp_kses_post() as its primary output filter for certain contexts. While wp_kses_post is designed to strip dangerous HTML tags and attributes, it preserves structural integrity of allowed elements. In this flawed implementation, the injected JavaScript payloads are structured in a way that bypasses these restrictions or are decoded by subsequent administrative JavaScript routines before being executed. Consequently, when an administrator loads the compromised page, their browser automatically decodes and executes the malicious script within the context of the admin session.
This execution environment grants the attacker significant leverage over the WordPress installation. Since the code runs with the privileges of the logged-in administrator, it can perform any action that a legitimate site owner could take. This includes creating new administrative users to maintain persistent access, modifying website content and settings, exfiltrating sensitive data from the database, or installing further malware such as web shells or backdoors. The attack aligns with MITRE ATT&CK techniques related to Client-Side Scripting Injection and potentially Account Manipulation if used to create persistence mechanisms.
Mitigation strategies must address both immediate remediation and long-term security hygiene. The most effective solution is to upgrade the Formidable Forms plugin to version 6.34 or later, where these input validation and output escaping issues have been resolved by the developers. For sites that cannot immediately update due to compatibility concerns, implementing a Web Application Firewall can help block requests containing known XSS patterns targeting the frm_user_id parameter. Additionally, administrators should review their WordPress REST API settings to restrict user enumeration if possible, although this is often limited by core functionality requirements. Regular security audits and code reviews focusing on sanitization practices in custom form handling logic are also recommended to prevent similar vulnerabilities from being introduced or persisting in other parts of the application stack.