CVE-2017-20194: medium-severity vulnerability in strategy11team Formidable Forms – Contact Form…
Formidable Form Builder < 2.05.03 - Unauthenticated Information Disclosure
Published · Updated
Follow this CVE+ Monitor Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
50Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actcvss 5.3epss 1.1%
from disclosure to weapon
Published on NVDOct 16
VulnCheckOct 15
The Formidable Form Builder plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including, 2.05.03 via the frm_forms_preview AJAX action. This makes it possible for unauthenticated attackers to export all of the form entries for a given form.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
strategy11team · Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form BuilderRelated CVEs — strategy11team Formidable Forms – Contact Form…
In the same product, most dangerous first.
CVE-2017-20192HIGHFormidable Form Builder < 2.05.03 - Unauthenticated Stored Cross-Site ScriptingEPSS 1.1%CVE-2024-11188MEDIUMFormidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder <= 6.16.1.2 - Reflected Cross-Site Scripting via Custom HTML Form ParameterEPSS 0.4%CVE-2026-2888MEDIUMFormidable Forms <= 6.28 - Unauthenticated Payment Amount Manipulation via 'item_meta' ParameterEPSS 0.4%CVE-2023-6830MEDIUMFormidable Forms <= 6.7 - HTML InjectionEPSS 0.4%CVE-2024-6725MEDIUMFormidable Forms <= 6.11.1 - Authenticated (Subscriber+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2026-2890HIGHFormidable Forms <= 6.28 - Missing Authorization to Unauthenticated Payment Integrity Bypass via PaymentIntent ReuseEPSS 0.4%