Description

The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'frm_user_id' parameter in all versions up to, and including, 6.33.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By forging frm_user_id to match an administrator's user ID — discoverable via the public WordPress REST API — an unauthenticated attacker causes wp_kses_post() to serve as the only output filter, which preserves the injected payload structurally intact; the plugin's admin JavaScript then decodes and executes it automatically on page load.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-26T07:16:45.360Z",
  "pubdate": "2026-08-26T07:16:45.360Z",
  "executiveSummary": "The Formidable Forms WordPress plugin is susceptible to Stored Cross-Site Scripting (XSS) due to inadequate input sanitization and output escaping within the 'frm_user_id' parameter.\nThis vulnerability affects all versions up to and including 6.33.1, allowing unauthenticated attackers to inject malicious JavaScript payloads.\nThe flaw stems from the plugin's failure to properly sanitize user-supplied data, which is subsequently processed and executed by the plugin's administrative interface.\nBy manipulating the 'frm_user_id' to correspond with an administrator account—whose identifier can be harvested via the public WordPress REST API—an attacker can bypass existing security filters.\nThe impact is significant, as the injected scripts execute automatically within the context of an administrator's browser session, potentially leading to unauthorized administrative actions, session hijacking, or site-wide compromise.\nSuccessful exploitation requires no prior authentication, posing a severe risk to WordPress installations using this plugin.",
  "technicalDetails": "The vulnerability resides in the handling of the 'frm_user_id' parameter, which fails to undergo rigorous validation before being stored and later retrieved by the plugin.\nThe root cause is identified as insufficient sanitization during input and the reliance on 'wp_kses_post()' as the sole output filter. While 'wp_kses_post()' is intended to strip malicious HTML, it is insufficient to neutralize payloads specifically crafted to exploit the plugin's internal administrative JavaScript processing.\nThe exploitation flow begins with the attacker querying the public WordPress REST API to enumerate user IDs, specifically identifying the administrator account. Once the target ID is obtained, the attacker crafts a malicious request injecting the XSS payload into the 'frm_user_id' parameter.\nBecause the 'frm_user_id' is associated with an administrator ID, the plugin's internal logic reduces its security posture, incorrectly trusting the integrity of the data. The injected payload is stored in the WordPress database without being properly sanitized to prevent execution.\nWhen an administrator accesses a page containing the injected entry, the plugin's administrative JavaScript component retrieves the payload. Crucially, the plugin includes functionality that decodes and executes content dynamically, treating the stored payload as legitimate code rather than untrusted text.\nThis mechanism causes the payload to execute within the browser context of the logged-in administrator, effectively bypassing the intended security boundaries of the 'wp_kses_post()' filter. Because the execution occurs in the session of a privileged user, the attacker can perform arbitrary actions, such as creating new admin accounts, modifying site settings, or redirecting visitors to malicious domains.\nThe vulnerability is present in all versions up to and including 6.33.1. It is accessible over the network to any unauthenticated remote attacker, as it does not require prior knowledge of login credentials or administrative privileges to initiate the injection process."
}