CVE-2026-85641: Formidable Forms WordPress XSS Vulnerability

CVE-2026-85641 Overview

CVE-2026-85641 affects the Formidable Forms WordPress plugin in versions prior to 6.35. The plugin fails to restrict who can set the identifier that records which user last edited a form entry. It then relies on this same identifier to decide whether to strip HTML from stored entry values. Unauthenticated visitors can supply an administrator identifier with their submission, causing markup to render in the admin entry view and falsely attributing the entry to a legitimate administrator. The flaw is categorized under Insufficient Verification of Data Authenticity [CWE-345].

Critical Impact
Unauthenticated attackers can inject unsanitized HTML into the admin entry view and impersonate administrators as the last editor of a form entry.

Affected Products

Formidable Forms WordPress plugin versions prior to 6.35
WordPress sites using Formidable Forms for entry collection
Administrative dashboards displaying stored Formidable form entries

Discovery Timeline

2026-09-16 - CVE-2026-85641 published to the National Vulnerability Database
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-85641

Vulnerability Analysis

The vulnerability arises from a trust decision made against an attacker-controllable value. Formidable Forms stores an identifier representing the user who last edited a form entry. The plugin uses this identifier to determine whether stored entry values require HTML stripping before display. When a submission claims to originate from a privileged user, the plugin skips sanitization and renders the raw markup in the WordPress administrative entry view.

Because the identifier is not authenticated, unauthenticated visitors can supply an arbitrary user identifier alongside their submission. This produces two distinct outcomes. First, HTML tags injected into entry fields render inside the admin interface. Second, the entry is attributed to a user who never submitted it, undermining audit integrity within the plugin's own records.

Exploitation requires user interaction from an administrator who opens the entry view, consistent with the vector element UI:R in the published metrics. The impact is confined to integrity, with no direct effect on confidentiality or availability.

Root Cause

The root cause is a failure to verify the authenticity of a security-relevant field before using it as an authorization signal. The plugin conflates a stored value that any client can influence with an authenticated identity claim. Sanitization logic that keys off this value inherits the same weakness.

Attack Vector

An unauthenticated attacker submits a form entry to a vulnerable Formidable Forms endpoint. The attacker sets the last-editor identifier field to match a WordPress administrator account and embeds HTML markup in one or more entry fields. When an administrator subsequently views the entry through the plugin's admin interface, the stored HTML renders in the browser and the entry appears to have been last edited by the impersonated administrator. Verified technical details are available in the WPScan Vulnerability Advisory.

Detection Methods for CVE-2026-85641

Indicators of Compromise

Form entries in the Formidable Forms admin view containing raw HTML tags such as <script>, <iframe>, or <img> in text fields
Entries attributed to administrator accounts as "last edited by" without corresponding administrator activity in WordPress audit logs
Submission requests to Formidable Forms endpoints containing unexpected user identifier parameters from unauthenticated sessions

Detection Strategies

Compare the last-editor identifier recorded on Formidable Forms entries against WordPress user activity logs for the same timeframe
Inspect stored entry values for HTML tags in fields that should contain plain text
Review web server access logs for POST requests to Formidable Forms submission handlers that include user identifier fields from anonymous clients

Monitoring Recommendations

Alert on anonymous form submissions that include parameters normally set only by authenticated administrative workflows
Monitor the WordPress database table storing Formidable Forms entries for values containing HTML markup
Track administrator sessions and correlate them with entry edit attributions to detect mismatches

How to Mitigate CVE-2026-85641

Immediate Actions Required

Upgrade the Formidable Forms plugin to version 6.35 or later on all WordPress installations
Audit existing form entries for HTML content and reset any "last edited by" attributions that cannot be reconciled with genuine administrator activity
Restrict access to the WordPress admin entry view to trusted administrators only

Patch Information

Upgrade Formidable Forms to version 6.35 or later, which restricts who can set the last-editor identifier and applies HTML sanitization independently of that value. Refer to the WPScan Vulnerability Advisory for the authoritative fix reference.

Workarounds

Disable the Formidable Forms plugin until the update to version 6.35 or later can be applied
Place a web application firewall rule in front of Formidable Forms submission endpoints to strip or reject user identifier parameters from unauthenticated clients
Restrict access to Formidable Forms submission URLs by IP address where public availability is not required

bash

# Update Formidable Forms via WP-CLI
wp plugin update formidable --version=6.35
wp plugin list --name=formidable --fields=name,status,version