Stored Cross-Site Scripting Vulnerability in Formidable Forms Plugin for WordPress

CVE-2026-18331

What is CVE-2026-18331?

The Formidable Forms plugin for WordPress is prone to a stored cross-site scripting vulnerability through the 'frm_user_id' parameter in all versions up to and including 6.33.1. This vulnerability arises from inadequate input sanitization and output escaping, allowing unauthenticated attackers to inject malicious web scripts. By forging the 'frm_user_id' to match an admin's user ID, which can be discovered via the WordPress REST API, attackers can cause the wp_kses_post() function to serve as the primary output filter. As a result, the injected payload remains structurally intact, and the plugin's admin JavaScript automatically decodes and executes it upon page load, posing significant security risks to users.

References