WordPress plugin
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 29 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical4
- High8
- Medium17
- Low0
All Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High8.8 | Authenticated (Subscriber+) Arbitrary Plugin Installation via 'file_url' Parameter ≤6.35Update to 7.0 | CVE-2026-89435 | |
| High7.5 | Unauthenticated Denial of Service <7.0Update to 7.0 | CVE-2026-85642 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting via 'frm_user_id' Parameter ≤6.33.1Update to 6.34 | CVE-2026-18331 | |
| High7.5 | Missing Authorization to Unauthenticated Payment Integrity Bypass via PaymentIntent Reuse ≤6.28Update to 6.29 | CVE-2026-2890 | |
| Critical9.8 | Unauthenticated PHP Object Injection ≤6.1.2Update to 6.2 | CVE-2023-1405 | |
| High7.1 | Cross-Site Request Forgery ≤5.5.6Update to 5.5.7 | CVE-2023-24419 | |
| Critical9.6 | Unauthenticated Stored Cross-Site Scripting <4.09.05Update to 4.09.05 | CVE-2021-24884 | |
| Critical9.8 | PHP Object Injection <4.02.01Update to 4.02.01 | CVE-2019-15780 | |
| High8.6 | SQL Injection <2.05.03Update to 2.05.03 | — | |
| High8.3 | Unauthenticated Stored Cross-Site Scripting <2.05.03Update to 2.05.03 | CVE-2017-20192 | |
| Critical9.1 | Missing Authorization Checks ≤2.0.21Update to 2.0.22 | — | |
| High8.8 | SQL Injection ≤1.07.11Update to 2.0 | CVE-2014-9309 |
- High8.8Authenticated (Subscriber+) Arbitrary Plugin Installation via 'file_url' Parameter
≤6.35Update to 7.0
- High7.5Unauthenticated Denial of Service
<7.0Update to 7.0
- High7.2Unauthenticated Stored Cross-Site Scripting via 'frm_user_id' Parameter
≤6.33.1Update to 6.34
- High7.5Missing Authorization to Unauthenticated Payment Integrity Bypass via PaymentIntent Reuse
≤6.28Update to 6.29
- Critical9.8Unauthenticated PHP Object Injection
≤6.1.2Update to 6.2
- High7.1Cross-Site Request Forgery
≤5.5.6Update to 5.5.7
- Critical9.6Unauthenticated Stored Cross-Site Scripting
<4.09.05Update to 4.09.05
- Critical9.8PHP Object Injection
<4.02.01Update to 4.02.01
- High8.6SQL Injection
<2.05.03Update to 2.05.03
- High8.3Unauthenticated Stored Cross-Site Scripting
<2.05.03Update to 2.05.03
- Critical9.1Missing Authorization Checks
≤2.0.21Update to 2.0.22
- High8.8SQL Injection
≤1.07.11Update to 2.0
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder: common questions
Does Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder have known vulnerabilities?
Yes. VulnCrest Radar lists 29 known vulnerabilities in Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder: 4 critical, 8 high, 17 medium. None are known to affect version null.
How do I check which version of Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder vulnerability?
CVE-2026-89435, published Oct 29, 2026: Formidable Forms <= 6.35 - Authenticated (Subscriber+) Arbitrary Plugin Installation via 'file_url' Parameter. Severity: High (CVSS 8.8).
Is any Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder vulnerability listed in CISA KEV?
No. None of the known Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder vulnerabilities is currently listed in the CISA KEV catalog.