Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder vulnerabilities

Product

Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder

by strategy11team · last CVE Mar 13, 2026

CVEs

On KEV

7.5

Max CVSS

New 30D

Vulnerabilities9 In the news0 Timeline

Severity mix

Critical 0High 1Medium 8Low 0

Severity

All severities9 Critical0 High1 Medium8 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-2890	7.5	0%	Mar 13	Formidable Forms <= 6.28 - Missing Authorization to Unauthenticated Payment Integrity Bypass via PaymentIntent Reuse Affected: through 6.28
CVE-2024-11188	6.1	0%	Nov 23	Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder <= 6.16.1.2 - Reflected Cross-Site Scripting via Custom HTML Form Parameter Affected: through 6.16.1.2
CVE-2017-20192	6.1	1%	Oct 16	Formidable Form Builder < 2.05.03 - Unauthenticated Stored Cross-Site Scripting Affected: before 2.05.03
CVE-2023-6830	6.1	0%	Jan 9	Formidable Forms <= 6.7 - HTML Injection Affected: through 6.7
CVE-2024-6725	5.4	0%	Jul 31	Formidable Forms <= 6.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting Affected: through 6.11.1
CVE-2026-2888	5.3	0%	Mar 13	Formidable Forms <= 6.28 - Unauthenticated Payment Amount Manipulation via 'item_meta' Parameter Affected: through 6.28
CVE-2017-20194	5.3	1%	Oct 16	Formidable Form Builder < 2.05.03 - Unauthenticated Information Disclosure Affected: before 2.05.03
CVE-2023-6842	4.8	0%	Jan 9	Formidable Forms <= 6.7 - Authenticated (Administrator+) Stored Cross-Site Scripting Affected: through 6.7
CVE-2024-0660	4.3	0%	Feb 5	Formidable Forms <= 6.7.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting Affected: through 6.7.2