CVE-2026-18331: Formidable Forms WordPress Plugin XSS Flaw

CVE-2026-18331 Overview

CVE-2026-18331 is a Stored Cross-Site Scripting (XSS) vulnerability in the Formidable Forms WordPress plugin. The flaw affects all versions of the plugin up to and including 6.33.1. The vulnerability originates in the frm_user_id parameter, which suffers from insufficient input sanitization and output escaping [CWE-79]. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses the affected page. Attackers forge frm_user_id values to match an administrator user ID, which is discoverable through the public WordPress REST API. The plugin then relies solely on wp_kses_post() for filtering, which preserves the payload structure so that the plugin's admin JavaScript decodes and executes it on page load.

Critical Impact
An unauthenticated network attacker can persistently inject scripts that execute in an administrator's browser session, enabling account takeover and privileged actions across the WordPress site.

Affected Products

Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin
All versions up to and including 6.33.1
WordPress installations exposing the public REST API user endpoint

Discovery Timeline

2026-08-26 - CVE-2026-18331 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-18331

Vulnerability Analysis

The vulnerability is a Stored Cross-Site Scripting flaw in the Formidable Forms plugin's entry-handling logic. The plugin accepts a frm_user_id parameter from unauthenticated form submissions and stores the associated entry data without adequate sanitization. When an administrator views the entry in the admin interface, the plugin renders the stored value through wp_kses_post(), which allows a permissive set of HTML tags and attributes. The plugin's admin JavaScript then decodes the stored payload and executes it in the administrator's authenticated context.

By forging frm_user_id to match an administrator ID discovered via the WordPress REST API user enumeration endpoint, an attacker binds the injected content to a privileged user record. This turns a typical form submission into a persistent XSS delivery mechanism against site administrators.

Root Cause

The root cause is a combination of two failures. First, the plugin does not sufficiently sanitize the frm_user_id parameter or the entry field content on submission. Second, the output path relies on wp_kses_post() as the only filter, which is designed to permit post-style HTML rather than block executable script content in dynamic admin contexts. The admin-side JavaScript compounds the flaw by decoding stored values and injecting them into the DOM at page load.

Attack Vector

An unauthenticated remote attacker enumerates administrator user IDs through the public WordPress REST API (for example, /wp-json/wp/v2/users). The attacker then submits a crafted form entry with frm_user_id set to that administrator ID and a payload embedded in an entry field. When any administrator subsequently views the entries page, the plugin's admin JavaScript decodes and executes the payload with the administrator's privileges. Refer to the Wordfence Vulnerability Analysis and the Formidable Admin JavaScript source for technical details.

Detection Methods for CVE-2026-18331

Indicators of Compromise

Form entries containing HTML tags, encoded script payloads, or javascript: URIs in text fields
Requests to /wp-json/wp/v2/users from external IP addresses preceding form submissions
Entries where frm_user_id values map to accounts with administrator role
Unexpected outbound requests originating from administrator browser sessions after viewing the entries page

Detection Strategies

Inspect the wp_frm_items and related plugin tables for entry meta values containing <script, onerror=, onload=, or base64-encoded payloads
Correlate REST API user enumeration attempts with subsequent unauthenticated POST requests to Formidable form endpoints
Monitor administrator sessions for anomalous XHR or fetch calls that follow admin page loads of /wp-admin/admin.php?page=formidable-entries

Monitoring Recommendations

Enable WordPress and web application firewall logging for all /wp-json/ and admin-ajax.php requests tied to the frm_ action namespace
Alert on submissions where the frm_user_id parameter is present but the submission is unauthenticated
Review plugin file integrity against upstream sources such as the FrmEntry model

How to Mitigate CVE-2026-18331

Immediate Actions Required

Update the Formidable Forms plugin to a version later than 6.33.1 as soon as the vendor releases a fixed build
Audit existing form entries for stored payloads and purge any entries containing embedded HTML or script content
Restrict access to the WordPress REST API users endpoint for unauthenticated visitors to prevent administrator ID enumeration

Patch Information

At the time of publication, refer to the Wordfence advisory and the Formidable plugin repository for the latest fixed version and patch commit details. Apply the vendor-supplied update through the WordPress plugin manager and validate that the deployed version is later than 6.33.1.

Workarounds

Deploy a web application firewall rule blocking unauthenticated requests that include the frm_user_id parameter with an ID that resolves to a privileged user
Disable public REST API user enumeration by filtering the rest_endpoints hook or via a security plugin
Temporarily restrict administrator access to the Formidable entries page until the plugin is patched

bash

# Configuration example: block unauthenticated REST API user enumeration in functions.php
add_filter( 'rest_endpoints', function( $endpoints ) {
    if ( ! is_user_logged_in() ) {
        unset( $endpoints['/wp/v2/users'] );
        unset( $endpoints['/wp/v2/users/(?P<id>[\d]+)'] );
    }
    return $endpoints;
} );