Cross-Site Scripting
9 records39.1%First: 2017. Latest: 2024.
Plugin security history
Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More Vulnerability History & Security Timeline
The Wordfence Intelligence dataset currently contains 23 vulnerability records associated with Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More, published between 2016 and 2026.
Dataset last synchronized: 2026-08-03 00:31:25 UTC
At a glance
Security Snapshot
23Total records
4Critical
5High
14Medium
0Low
0Informational
23Patched records
0Currently marked unpatched
2016-01-26First disclosure
2026-03-12Latest disclosure
19 of 23CVE coverage
Use this history
Check and watch Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More.
A history record does not establish whether the version installed on your website is affected. Enter the exact version in the checker, or add this software to a private Critical/High alert watchlist.
Year-by-Year Timeline
| Year | Records | Relative volume |
|---|---|---|
| 2016 | 2 | |
| 2017 | 4 | |
| 2019 | 1 | |
| 2021 | 2 | |
| 2022 | 2 | |
| 2023 | 4 | |
| 2024 | 6 | |
| 2026 | 2 |
Severity Breakdown
| Severity | Records | Share |
|---|---|---|
| Critical | 4 | 17.4% |
| High | 5 | 21.7% |
| Medium | 14 | 60.9% |
Vulnerability-Type Breakdown
Other
4 records17.4%First: 2019. Latest: 2023.
CSRF
3 records13%First: 2022. Latest: 2024.
Missing Authorization
3 records13%First: 2023. Latest: 2026.
SQL Injection
2 records8.7%First: 2016. Latest: 2017.
Privilege Escalation
1 record4.3%First: 2016. Latest: 2016.
Information Disclosure
1 record4.3%First: 2017. Latest: 2017.
Patch Status
- Patched
- 23
- Currently marked unpatched
- 0
- Unknown status
- 0
Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.
Latest Known Patched Versions
6.296.16.26.14.16.11.26.86.7.16.3.16.26.15.5.75.5.55.0.074.09.054.02.012.05.032.0.222.0
Affected-Version History
Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.
| Affected range | Vulnerability | Published | Patched version | Severity |
|---|---|---|---|---|
*-6.28 | Formidable Forms <= 6.28 - Unauthenticated Payment Amount Manipulation via 'item_meta' Parameter | March 12, 2026 | 6.29 | Medium |
*-6.28 | Formidable Forms <= 6.28 - Missing Authorization to Unauthenticated Payment Integrity Bypass via PaymentIntent Reuse | March 12, 2026 | 6.29 | High |
*-6.16.1.2 | Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder <= 6.16.1.2 - Reflected Cross-Site Scripting via Custom HTML Form Parameter | November 22, 2024 | 6.16.2 | Medium |
*-6.14 | Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder <= 6.14 - Authenticated (Admin+) Stored Cross-Site Scripting | October 31, 2024 | 6.14.1 | Medium |
*-6.11.1 | Formidable Forms <= 6.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting | July 30, 2024 | 6.11.2 | Medium |
*-6.7.2 | Formidable Forms <= 6.7.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting | January 26, 2024 | 6.8 | Medium |
*-6.7 | Formidable Forms <= 6.7 - HTML Injection | January 8, 2024 | 6.7.1 | Medium |
*-6.7 | Formidable Forms <= 6.7 - Authenticated (Administrator+) Stored Cross-Site Scripting | January 8, 2024 | 6.7.1 | Medium |
[*, 6.3.1) | Formidable Forms <= 6.3 - Authenticated (Subscriber+) Arbitrary Plugin Installation and Activation | May 31, 2023 | 6.3.1 | Medium |
*-6.1.2 | Formidable Forms <= 6.1.2 - Unauthenticated PHP Object Injection | April 6, 2023 | 6.2 | Critical |
*-6.0.1 | Formidable Forms <= 6.0.1 - IP Spoofing via HTTP header | March 6, 2023 | 6.1 | Medium |
*-5.5.6 | Formidable Form Builder <= 5.5.6 - Cross-Site Request Forgery | February 1, 2023 | 5.5.7 | High |
*-5.5.4 | Formidable Forms <= 5.5.4 - Authenticated (Admin+) Server-Side Request Forgery | December 16, 2022 | 5.5.5 | Medium |
*-5.5.4 | Formidable Form Builder <= 5.5.4 - Cross-Site Request Forgery | December 16, 2022 | 5.5.5 | Medium |
[*, 5.0.07) | Formidable Form Builder <= 5.0.06 - Admin+ Stored Cross-Site Scripting | October 6, 2021 | 5.0.07 | Medium |
[*, 4.09.05) | Formidable Form Builder <= 4.09.04 - Unauthenticated Stored Cross-Site Scripting | January 28, 2021 | 4.09.05 | Critical |
[*, 4.02.01) | Formidable Form Builder <= 4.02 - PHP Object Injection | August 9, 2019 | 4.02.01 | Critical |
[*, 2.05.03) | Formidable Form Builder < 2.05.03 - Reflected Cross-Site Scripting | November 13, 2017 | 2.05.03 | Medium |
[*, 2.05.03) | Formidable Form Builder < 2.05.03 - Unauthenticated Stored Cross-Site Scripting | November 13, 2017 | 2.05.03 | High |
[*, 2.05.03) | Formidable Form Builder < 2.05.03 - SQL Injection | November 13, 2017 | 2.05.03 | High |
[*, 2.05.03) | Formidable Form Builder < 2.05.03 - Unauthenticated Information Disclosure | November 12, 2017 | 2.05.03 | Medium |
*-2.0.21 | Formidable Form Builder <= 2.0.21 - Missing Authorization Checks | February 16, 2016 | 2.0.22 | Critical |
*-1.07.11 | Formidable Form Builder <= 1.07.11 - SQL Injection | January 26, 2016 | 2.0 | High |
Selected source records
Latest Records
MediumCVE-2026-2888
Formidable Forms <= 6.28 - Unauthenticated Payment Amount Manipulation via 'item_meta' Parameter
Published: March 12, 2026
- Affected versions
- *-6.28
- Patched versions
- 6.29
HighCVE-2026-2890
Formidable Forms <= 6.28 - Missing Authorization to Unauthenticated Payment Integrity Bypass via PaymentIntent Reuse
Published: March 12, 2026
- Affected versions
- *-6.28
- Patched versions
- 6.29
MediumCVE-2024-11188
Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder <= 6.16.1.2 - Reflected Cross-Site Scripting via Custom HTML Form Parameter
Published: November 22, 2024
- Affected versions
- *-6.16.1.2
- Patched versions
- 6.16.2
MediumCVE-2024-9768
Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder <= 6.14 - Authenticated (Admin+) Stored Cross-Site Scripting
Published: October 31, 2024
- Affected versions
- *-6.14
- Patched versions
- 6.14.1
MediumCVE-2024-6725
Formidable Forms <= 6.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Published: July 30, 2024
- Affected versions
- *-6.11.1
- Patched versions
- 6.11.2
MediumCVE-2024-0660
Formidable Forms <= 6.7.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published: January 26, 2024
- Affected versions
- *-6.7.2
- Patched versions
- 6.8
MediumCVE-2023-6842
Formidable Forms <= 6.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published: January 8, 2024
- Affected versions
- *-6.7
- Patched versions
- 6.7.1
MediumCVE-2023-6830
Formidable Forms <= 6.7 - HTML Injection
Published: January 8, 2024
- Affected versions
- *-6.7
- Patched versions
- 6.7.1
Highest-Severity Records
CriticalCVE-2023-1405
Formidable Forms <= 6.1.2 - Unauthenticated PHP Object Injection
Published: April 6, 2023
- Affected versions
- *-6.1.2
- Patched versions
- 6.2
CriticalCVE-2019-15780
Formidable Form Builder <= 4.02 - PHP Object Injection
Published: August 9, 2019
- Affected versions
- [*, 4.02.01)
- Patched versions
- 4.02.01
CriticalCVE-2021-24884
Formidable Form Builder <= 4.09.04 - Unauthenticated Stored Cross-Site Scripting
Published: January 28, 2021
- Affected versions
- [*, 4.09.05)
- Patched versions
- 4.09.05
Critical
Formidable Form Builder <= 2.0.21 - Missing Authorization Checks
Published: February 16, 2016
- Affected versions
- *-2.0.21
- Patched versions
- 2.0.22
HighCVE-2014-9309
Formidable Form Builder <= 1.07.11 - SQL Injection
Published: January 26, 2016
- Affected versions
- *-1.07.11
- Patched versions
- 2.0
High
Formidable Form Builder < 2.05.03 - SQL Injection
Published: November 13, 2017
- Affected versions
- [*, 2.05.03)
- Patched versions
- 2.05.03
HighCVE-2017-20192
Formidable Form Builder < 2.05.03 - Unauthenticated Stored Cross-Site Scripting
Published: November 13, 2017
- Affected versions
- [*, 2.05.03)
- Patched versions
- 2.05.03
HighCVE-2026-2890
Formidable Forms <= 6.28 - Missing Authorization to Unauthenticated Payment Integrity Bypass via PaymentIntent Reuse
Published: March 12, 2026
- Affected versions
- *-6.28
- Patched versions
- 6.29
Need help reviewing an exposed WordPress website?
Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.
Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.
Data Source, Attribution and Methodology
This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.