TI-2021-07166 Aliases CVE-2021-24884 GHSA-h6gj-jhrr-g634

Formidable Form Builder < 4.09.05 - Unauthenticated Stored Cross-Site Scripting

MEDIUM 47CWE-79Published 2021-10-25 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting, Tampering
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79 and CWE-352.

Summary

The Formidable Form Builder WordPress plugin before 4.09.05 allows to inject certain HTML Tags like <audio>,<video>,<img>,<a> and<button>.This could allow an unauthenticated, remote attacker to exploit a HTML-injection byinjecting a malicous link. The HTML-injection may trick authenticated users to follow the link. If the Link gets clicked, Javascript code can be executed. The vulnerability is due to insufficient sanitization of the "data-frmverify" tag for links in the web-based entry inspection page of affected systems. A successful exploitation incomibantion with CSRF could allow the attacker to perform arbitrary actions on an affected system with the privileges of the user. These actions include stealing the users account by changing their password or allowing attackers to submit their own code through an authenticated user resulting in Remote Code Execution. If an authenticated user who is able to edit Wordpress PHP Code in any kind, clicks the malicious link, PHP code can be edited.

Why it matters now

EPSS 0.03134 87th percentileScored 2026-11-07

Public exploit Yes 2 exploit referencesTagged by NVD

Fix Fixed Formidable Form Builder – Contact Form, Survey & Quiz Forms Plugin for WordPress (Unknown): 4.09.05

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Unknown	Formidable Form Builder – Contact Form, Survey & Quiz Forms Plugin for WordPress	4.09.05 to before 4.09.05	4.09.05	Patch available	CNA

Formidable Form Builder – Contact Form, Survey & Quiz Forms Plugin for WordPress VendorUnknown Affected 4.09.05 to before 4.09.05 Fixed in 4.09.05 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:strategy11:formidable_form_builder::::::wordpress::*	before 4.09.05	Vulnerable	strategy11team

cpe:2.3:a:strategy11:formidable_form_builder:*:*:*:*:*:wordpress:*:* Versions before 4.09.05 Vulnerable ·strategy11team

Remediation

Fix · CNA Formidable Form Builder – Contact Form, Survey & Quiz Forms Plugin for WordPress (Unknown) Fixed in 4.09.05

Timeline

2026-10-02 Threatist record created from CVE-2021-24884
2026-10-03 Alias added: GHSA-h6gj-jhrr-g634

References

Exploit 2

Patch 1

https://github.com/Strategy11/formidable-forms/pull/335/files

TI-2023-00774 Formidable Forms < 6.1 - IP Spoofing CVSS 3.1MEDIUM 6.5
TI-2019-11851 The formidable plugin before 4.02.01 for WordPress has unsafe deserialization. CVSS 3.1CRITICAL 9.8
TI-2017-14258 Formidable Form Builder < 2.05.03 - Unauthenticated Stored Cross-Site Scripting CVSS 3.1HIGH 8.3
TI-2023-10041 WordPress Formidable Forms Plugin <= 5.5.6 is vulnerable to Cross Site Request Forgery (CSRF) CVSS 3.1HIGH 8.8
TI-2023-06236 Formidable Forms <= 6.7 - HTML Injection CVSS 3.1MEDIUM 6.5
TI-2017-14260 Formidable Form Builder < 2.05.03 - Unauthenticated Information Disclosure CVSS 3.1MEDIUM 5.3

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences