Formidable Forms (Unknown) - vulnerabilities (CVEs)

8 CVEs, 1 in the last 30 days, 2 known versions, newest CVE from 2026-10-21. Vendor: Unknown.

CVEs of Formidable Forms

• CVE-2026-85642 - CVSS 7.5 (high), 2026-10-21: The Formidable Forms WordPress plugin before 7.0 does not verify the identity of the caller before recording the timestamp it uses to rate limit payment…
• CVE-2026-19857 - CVSS 4.8 (medium), 2026-09-16: The Formidable Forms WordPress plugin before 6.35 does not prevent a request-derived value from reaching the WordPress shortcode parser when it substitutes a…
• CVE-2026-85641 - CVSS 4.3 (medium), 2026-09-16: The Formidable Forms WordPress plugin before 6.35 does not restrict who can set the identifier recording which user last edited a form entry, and relies on…
• CVE-2026-11361 - CVSS 5.9 (medium), 2026-08-06: The Formidable Forms WordPress plugin before 6.32.1 does not properly validate the status of a PayPal subscription payment before marking it complete,…
• CVE-2024-9768 - CVSS 4.8 (medium), 2024-11-21: The Formidable Forms WordPress plugin before 6.14.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to…
• CVE-2023-1405 - CVSS 7.5 (high), 2024-01-16: The Formidable Forms WordPress plugin before 6.2 unserializes user input, which could allow anonymous users to perform PHP Object Injection when a suitable…
• CVE-2023-2877 - CVSS 8.8 (high), 2023-06-27: The Formidable Forms WordPress plugin before 6.3.1 does not adequately authorize the user or validate the plugin URL in its functionality for installing…
• CVE-2023-0816 - CVSS 6.5 (medium), 2023-03-27: The Formidable Forms WordPress plugin before 6.1 uses several potentially untrusted headers to determine the IP address of the client, leading to IP Address…