CVE-2017-20192: STRATEGY11 Formidable Form Builder

Medium severity, CVSS 6.1. EPSS: 1.1% chance of exploitation in the next 30 days.

The Formidable Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters submitted during form entries like 'after_html' in versions before 2.05.03 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in a victim's browser.

Affected products

• STRATEGY11 Formidable Form Builder: before 2.05.03 (fixed in 2.05.03)

Published 2024-10-16. Last modified 2026-06-17.