CVE-2026-18331: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in strategy11team Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More

The Formidable Forms – WordPress Form Builder plugin suffers from a stored cross-site scripting vulnerability in all versions up to and including 6.33.1. The vulnerability is triggered via the 'frm_user_id' parameter, which lacks proper input sanitization and output escaping. An unauthenticated attacker can exploit this by forging the frm_user_id to an administrator's user ID, discoverable through the public WordPress REST API. This manipulation causes the plugin to apply only the wp_kses_post() filter, which does not sufficiently neutralize the injected script. Consequently, the plugin's admin JavaScript decodes and executes the malicious payload automatically when the page loads, potentially compromising user sessions or performing other malicious actions.

An unauthenticated attacker can inject and execute arbitrary JavaScript in the context of the affected WordPress site’s admin pages. This can lead to session hijacking, privilege escalation, or other malicious activities impacting confidentiality and integrity. The vulnerability does not affect availability. The CVSS 3.1 base score is 7.2 (High), reflecting network attack vector, low complexity, no privileges required, no user interaction, and partial impact on confidentiality and integrity with no impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the WordPress REST API and administrative interfaces to trusted users only. Monitor for updates from the vendor strategy11team and apply patches promptly once released. Avoid using affected versions in production environments where possible.