Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Formidable Forms 6.35 Clear all filters
TI-2026-16102 CVE-2026-19857 · GHSA-hgfq-v6h8-89x5

Formidable Forms < 6.35 - Unauthenticated Arbitrary Shortcode Execution via [entry_key] Custom HTML Token

Priority MEDIUM 55

The Formidable Forms WordPress plugin before 6.35 does not prevent a request-derived value from reaching the WordPress shortcode parser when it substitutes a supported token into a form's custom HTML, allowing unauthenti…

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.00229 Published 2026-09-16 Fixed in 6.35 CWE-74
TI-2026-58759 CVE-2026-85641 · GHSA-c92r-vvxr-8r78

Formidable Forms 6.34 - Unauthenticated Stored Content Injection via 'updated_by' Parameter

Priority LOW 19

The Formidable Forms WordPress plugin before 6.35 does not restrict who can set the identifier recording which user last edited a form entry, and relies on that identifier when deciding whether to strip HTML from stored…

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00142 Published 2026-09-16 Fixed in 6.35 CWE-345