VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder security & vulnerabilities

formidable— active installsLast vulnerability Oct 29, 2026

No known unpatched vulnerabilities in the latest version

All 29 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin
29Known vulnerabilities
  • Critical4
  • High8
  • Medium17
  • Low0
Vulnerabilities per year
2016: 2 vulnerabilities2162017: 4 vulnerabilities4172019: 1 vulnerability1192021: 2 vulnerabilities2212022: 2 vulnerabilities2222023: 4 vulnerabilities4232024: 6 vulnerabilities6242026: 8 vulnerabilities826

All Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder vulnerabilities

Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder vulnerabilities
SeverityVulnerabilityCVEPublished
High8.8Authenticated (Subscriber+) Arbitrary Plugin Installation via 'file_url' Parameter
≤6.35Update to 7.0
CVE-2026-89435
High7.5Unauthenticated Denial of Service
<7.0Update to 7.0
CVE-2026-85642
Medium5.3Unauthenticated Content Injection
≤6.34Update to 6.35
CVE-2026-85641
Medium6.5Unauthenticated Arbitrary Shortcode Execution
≤6.34Update to 6.35
CVE-2026-19857
High7.2Unauthenticated Stored Cross-Site Scripting via 'frm_user_id' Parameter
≤6.33.1Update to 6.34
CVE-2026-18331
Medium5.3Unauthenticated Payment Bypass
≤6.32.0Update to 6.32.1
CVE-2026-11361
Medium5.3Unauthenticated Payment Amount Manipulation via 'item_meta' Parameter
≤6.28Update to 6.29
CVE-2026-2888
High7.5Missing Authorization to Unauthenticated Payment Integrity Bypass via PaymentIntent Reuse
≤6.28Update to 6.29
CVE-2026-2890
Medium6.1Reflected Cross-Site Scripting via Custom HTML Form Parameter
≤6.16.1.2Update to 6.16.2
CVE-2024-11188
Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤6.14Update to 6.14.1
CVE-2024-9768
Medium4.9Authenticated (Subscriber+) Stored Cross-Site Scripting
≤6.11.1Update to 6.11.2
CVE-2024-6725
Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting
≤6.7.2Update to 6.8
CVE-2024-0660
Medium6.5HTML Injection
≤6.7Update to 6.7.1
CVE-2023-6830
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤6.7Update to 6.7.1
CVE-2023-6842
Medium6.5Authenticated (Subscriber+) Arbitrary Plugin Installation and Activation
<6.3.1Update to 6.3.1
CVE-2023-2877
Critical9.8Unauthenticated PHP Object Injection
≤6.1.2Update to 6.2
CVE-2023-1405
Medium5.3IP Spoofing via HTTP header
≤6.0.1Update to 6.1
CVE-2023-0816
High7.1Cross-Site Request Forgery
≤5.5.6Update to 5.5.7
CVE-2023-24419
Medium5.4Cross-Site Request Forgery
≤5.5.4Update to 5.5.5
CVE-2022-45806
Medium4.7Authenticated (Admin+) Server-Side Request Forgery
≤5.5.4Update to 5.5.5
—
Medium4.8Admin+ Stored Cross-Site Scripting
<5.0.07Update to 5.0.07
CVE-2021-24608
Critical9.6Unauthenticated Stored Cross-Site Scripting
<4.09.05Update to 4.09.05
CVE-2021-24884
Critical9.8PHP Object Injection
<4.02.01Update to 4.02.01
CVE-2019-15780
High8.6SQL Injection
<2.05.03Update to 2.05.03
—
High8.3Unauthenticated Stored Cross-Site Scripting
<2.05.03Update to 2.05.03
CVE-2017-20192
Medium6.1Reflected Cross-Site Scripting
<2.05.03Update to 2.05.03
—
Medium5.3Unauthenticated Information Disclosure
<2.05.03Update to 2.05.03
CVE-2017-20194
Critical9.1Missing Authorization Checks
≤2.0.21Update to 2.0.22
—
High8.8SQL Injection
≤1.07.11Update to 2.0
CVE-2014-9309

Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder: common questions

Does Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder have known vulnerabilities?

Yes. VulnCrest Radar lists 29 known vulnerabilities in Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder: 4 critical, 8 high, 17 medium. None are known to affect version null.

How do I check which version of Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder vulnerability?

CVE-2026-89435, published Oct 29, 2026: Formidable Forms <= 6.35 - Authenticated (Subscriber+) Arbitrary Plugin Installation via 'file_url' Parameter. Severity: High (CVSS 8.8).

Is any Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder vulnerability listed in CISA KEV?

No. None of the known Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?