Unknown Formidable Forms vulnerabilities

3 CVEs affecting Unknown Formidable Forms, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-19857, published 2026-09-16.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-19857, published 2026-09-16. Medium severity, CVSS 4.8. EPSS: 0.2% chance of exploitation in the next 30 days. The Formidable Forms WordPress plugin before 6.35 does not prevent a request-derived value from reaching the WordPress shortcode parser when it substitutes a supported token into a form's custom…
CVE-2026-11361, published 2026-08-06. Medium severity, CVSS 5.9. EPSS: 0.2% chance of exploitation in the next 30 days. The Formidable Forms WordPress plugin before 6.32.1 does not properly validate the status of a PayPal subscription payment before marking it complete, allowing unauthenticated users to bypass payment…
CVE-2026-85641, published 2026-09-16. Medium severity, CVSS 4.3. EPSS: 0.1% chance of exploitation in the next 30 days. The Formidable Forms WordPress plugin before 6.35 does not restrict who can set the identifier recording which user last edited a form entry, and relies on that identifier when deciding whether to…