CVE-2026-18331

Name of the Vulnerable Software and Affected Versions Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More versions prior to 6.33.2

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that execute when a user accesses them. By forging the frm user id parameter to match an administrator's user ID, which can be obtained via the public WordPress REST API, the attacker ensures that wp kses post() acts as the sole output filter. This allows the injected payload to remain structurally intact, which the plugin's admin JavaScript then decodes and executes automatically upon page load.

Recommendations Update to version 6.33.2 or later. As a temporary mitigation, restrict access to the frm user id parameter to prevent unauthorized manipulation.