CVE-2024-6725mediumCWE-79

CVE-2024-6725: medium-severity vulnerability in strategy11team Formidable Forms – Contact Form…

Formidable Forms <= 6.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting

Published · Updated

Follow this CVE+ Monitor Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.9epss 0.4%
The Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘html’ parameter in all versions up to, and including, 6.11.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with form editing permissions and Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
Affected products
strategy11team · Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
Related CVEs — strategy11team Formidable Forms – Contact Form…

In the same product, most dangerous first.

CVE-2017-20194MEDIUMFormidable Form Builder < 2.05.03 - Unauthenticated Information DisclosureEPSS 1.1%CVE-2017-20192HIGHFormidable Form Builder < 2.05.03 - Unauthenticated Stored Cross-Site ScriptingEPSS 1.1%CVE-2024-11188MEDIUMFormidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder <= 6.16.1.2 - Reflected Cross-Site Scripting via Custom HTML Form ParameterEPSS 0.4%CVE-2026-2888MEDIUMFormidable Forms <= 6.28 - Unauthenticated Payment Amount Manipulation via 'item_meta' ParameterEPSS 0.4%CVE-2023-6830MEDIUMFormidable Forms <= 6.7 - HTML InjectionEPSS 0.4%CVE-2026-2890HIGHFormidable Forms <= 6.28 - Missing Authorization to Unauthenticated Payment Integrity Bypass via PaymentIntent ReuseEPSS 0.4%