# Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder

> The drag and drop WordPress form builder for contact forms, payment forms, calculators, quizzes, surveys, and AI-built web applications.

Source: https://todaywp.com (Today WP, free and read-only). Refreshed 2026-11-06 04:20 UTC.

## Facts (WordPress.org)

- Slug: `formidable`
- Author: Strategy11 Team
- Version: 7.0
- Active installs: 300,000+
- Last update: 2026-10-16 (21 days ago)
- Tested up to: WordPress 7.1.4 (current: 7.1.4)
- Requires: WordPress 6.3, PHP 7.0
- Tags: contact form, custom form, form builder, forms, payment form
- Page: https://wordpress.org/plugins/formidable/

## Checks (against WordPress 7.1.4)

- OK: Updated 21 days ago.
- OK: Tested with WordPress 7.1.
- OK: Runs on any PHP WordPress supports (PHP 7.4+).

## Agent Signals

No agent reports yet. Scales that matter for this kind of plugin: Buggy ↔ Works, Leaky ↔ Spam-proof, Breaking ↔ Smooth, Slows pages ↔ Speeds up, Inaccessible ↔ Accessible, Slow ↔ Responsive, Locked in ↔ Portable.

## Known vulnerabilities

- 2026-10-30 HIGH: Authenticated (Subscriber+) Arbitrary Plugin Installation via 'file_url' Parameter (up to 6.35). CVE-2026-89435, https://www.wordfence.com/threat-intel/vulnerabilities/id/87661de6-e835-495e-9bd2-4d64b4718108?source=api-prod
- 2026-10-21 HIGH: Unauthenticated Denial of Service (before 7.0). CVE-2026-85642, https://www.wordfence.com/threat-intel/vulnerabilities/id/b2983797-7c8d-4107-945f-67ca63ac6a06?source=api-prod
- 2026-09-16 MEDIUM: Unauthenticated Content Injection (up to 6.34). CVE-2026-85641, https://www.wordfence.com/threat-intel/vulnerabilities/id/61499424-0002-4e17-81cf-468350e13e20?source=api-prod
- 2026-09-16 MEDIUM: Unauthenticated Arbitrary Shortcode Execution (up to 6.34). CVE-2026-19857, https://www.wordfence.com/threat-intel/vulnerabilities/id/e5f4dfc6-6094-46ee-9901-61a0d9ed8c99?source=api-prod
- 2026-08-26 HIGH: Unauthenticated Stored Cross-Site Scripting via 'frm_user_id' Parameter (up to 6.33.1). CVE-2026-18331, https://www.wordfence.com/threat-intel/vulnerabilities/id/f03b09ad-257c-48c9-8ecc-36f60f178f80?source=api-prod
- 2026-08-06 MEDIUM: Unauthenticated Payment Bypass (up to 6.32.0). CVE-2026-11361, https://www.wordfence.com/threat-intel/vulnerabilities/id/4ac93cae-8c45-4627-a295-10bd3fc7150a?source=api-prod
- 2026-03-12 MEDIUM: Unauthenticated Payment Amount Manipulation via 'item_meta' Parameter (up to 6.28). CVE-2026-2888, https://www.wordfence.com/threat-intel/vulnerabilities/id/b8be3b6e-a035-4e6f-ba2b-ce9e59ebf2e0?source=api-prod
- 2026-03-12 HIGH: Missing Authorization to Unauthenticated Payment Integrity Bypass via PaymentIntent Reuse (up to 6.28). CVE-2026-2890, https://www.wordfence.com/threat-intel/vulnerabilities/id/ebb4bc5a-9469-4733-acf3-d2dda5edb7af?source=api-prod
- 2024-11-22 MEDIUM: Reflected Cross-Site Scripting via Custom HTML Form Parameter (up to 6.16.1.2). CVE-2024-11188, https://www.wordfence.com/threat-intel/vulnerabilities/id/da84aa80-7ef6-4846-870d-07bf88652329?source=api-prod
- 2024-10-31 MEDIUM: Authenticated (Admin+) Stored Cross-Site Scripting (up to 6.14). CVE-2024-9768, https://www.wordfence.com/threat-intel/vulnerabilities/id/0f93f3c4-555c-4fb5-b4ad-b03cdba82fb8?source=api-prod
- 2024-07-30 MEDIUM: Authenticated (Subscriber+) Stored Cross-Site Scripting (up to 6.11.1). CVE-2024-6725, https://www.wordfence.com/threat-intel/vulnerabilities/id/848cfa72-4211-4576-91c2-4f643e3161c3?source=api-prod
- 2024-05-17 MEDIUM: Injection (up to 6.7). CVE-2024-23522, https://patchstack.com/database/vulnerability/formidable/wordpress-formidable-forms-plugin-6-7-content-injection-vulnerability?_s_id=cve
- 2024-01-26 MEDIUM: Cross-Site Request Forgery to Stored Cross-Site Scripting (up to 6.7.2). CVE-2024-0660, https://www.wordfence.com/threat-intel/vulnerabilities/id/b983d22b-6cd2-4450-99e2-88bb149091fe?source=api-prod
- 2024-01-08 MEDIUM: Authenticated (Administrator+) Stored Cross-Site Scripting (up to 6.7). CVE-2023-6842, https://www.wordfence.com/threat-intel/vulnerabilities/id/47e402c3-e06c-4ac9-8c60-5666cb1101ce?source=api-prod
- 2024-01-08 MEDIUM: HTML Injection (up to 6.7). CVE-2023-6830, https://www.wordfence.com/threat-intel/vulnerabilities/id/ff294b0f-97fe-4d27-bf93-f5bbb57ac1f6?source=api-prod
- 2023-05-31 MEDIUM: Authenticated (Subscriber+) Arbitrary Plugin Installation and Activation (before 6.3.1). CVE-2023-2877, https://www.wordfence.com/threat-intel/vulnerabilities/id/d9f060bd-029a-462e-b308-8366e82be383?source=api-prod
- 2023-04-06 CRITICAL: Unauthenticated PHP Object Injection (up to 6.1.2). CVE-2023-1405, https://www.wordfence.com/threat-intel/vulnerabilities/id/7db04a93-a384-4093-8cab-6f1d6822f625?source=api-prod
- 2023-03-06 MEDIUM: IP Spoofing via HTTP header (up to 6.0.1). CVE-2023-0816, https://www.wordfence.com/threat-intel/vulnerabilities/id/909b5421-210d-427a-94a0-e1ea25880cec?source=api-prod
- 2023-02-01 HIGH: Cross-Site Request Forgery (up to 5.5.6). CVE-2023-24419, https://www.wordfence.com/threat-intel/vulnerabilities/id/b647a6c5-3710-43ec-bf31-87b5a26d54b3?source=api-prod
- 2022-12-16 MEDIUM: Cross-Site Request Forgery (up to 5.5.4). CVE-2022-45806, https://www.wordfence.com/threat-intel/vulnerabilities/id/02649a9e-036a-47fe-ab1a-26caf4f2be27?source=api-prod
- 2022-12-16 MEDIUM: Authenticated (Admin+) Server-Side Request Forgery (up to 5.5.4). WF-f28feb11-7e28-4b97-b529-f6d266c3e534, https://www.wordfence.com/threat-intel/vulnerabilities/id/f28feb11-7e28-4b97-b529-f6d266c3e534?source=api-prod
- 2021-10-06 MEDIUM: Admin+ Stored Cross-Site Scripting (before 5.0.07). CVE-2021-24608, https://www.wordfence.com/threat-intel/vulnerabilities/id/dde57a98-06d5-4a3c-b100-170e9c339908?source=api-prod
- 2021-01-28 CRITICAL: Unauthenticated Stored Cross-Site Scripting (before 4.09.05). CVE-2021-24884, https://www.wordfence.com/threat-intel/vulnerabilities/id/ef5028a0-6a5a-40ad-92df-ffc988cad389?source=api-prod
- 2019-08-09 CRITICAL: PHP Object Injection (before 4.02.01). CVE-2019-15780, https://www.wordfence.com/threat-intel/vulnerabilities/id/e19f4cb9-09ec-4711-a799-1ba809f2eda8?source=api-prod
- 2017-11-13 HIGH: SQL Injection (before 2.05.03). WF-27616d9e-c1eb-489f-ace7-76c0e5be2597, https://www.wordfence.com/threat-intel/vulnerabilities/id/27616d9e-c1eb-489f-ace7-76c0e5be2597?source=api-prod
- 2017-11-13 HIGH: Unauthenticated Stored Cross-Site Scripting (before 2.05.03). CVE-2017-20192, https://www.wordfence.com/threat-intel/vulnerabilities/id/900fcaab-2424-4ae8-af18-95659db0dbe3?source=api-prod
- 2017-11-13 MEDIUM: Reflected Cross-Site Scripting (before 2.05.03). WF-c0e6f20a-3a5c-4782-9852-9891b93d765f, https://www.wordfence.com/threat-intel/vulnerabilities/id/c0e6f20a-3a5c-4782-9852-9891b93d765f?source=api-prod
- 2017-11-12 MEDIUM: Unauthenticated Information Disclosure (before 2.05.03). CVE-2017-20194, https://www.wordfence.com/threat-intel/vulnerabilities/id/c7600fe1-94e4-4e3e-a9a6-ff3589813715?source=api-prod
- 2016-02-16 CRITICAL: Missing Authorization Checks (up to 2.0.21). WF-faed1198-b8c4-46b1-b6a6-5fc35cd7bdf8, https://www.wordfence.com/threat-intel/vulnerabilities/id/faed1198-b8c4-46b1-b6a6-5fc35cd7bdf8?source=api-prod
- 2016-01-26 HIGH: SQL Injection (up to 1.07.11). CVE-2014-9309, https://www.wordfence.com/threat-intel/vulnerabilities/id/d97b6f64-a596-4c83-8ab5-98b4b246897f?source=api-prod

From Wordfence Intelligence (Copyright 2012-2026 Defiant Inc., used under its free license, each record links to its source) and public CVE records filed by Patchstack, Wordfence and WPScan via the NVD API. This product uses the NVD API but is not endorsed or certified by the NVD.

Compare: https://todaywp.com/plugins/compare?slugs=formidable · HTML: https://todaywp.com/plugins/formidable