CVE-2026-18331

Formidable Forms <= 6.33.1 - Unauthenticated Stored Cross-Site Scripting via 'frm_user_id' Parameter

The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'frm_user_id' parameter in all versions up to, and including, 6.33.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By forging frm_user_id to match an administrator's user ID — discoverable via the public WordPress REST API — an unauthenticated attacker causes wp_kses_post() to serve as the only output filter, which preserves the injected payload structurally intact; the plugin's admin JavaScript then decodes and executes it automatically on page load.

We have discovered 67,566 live websites that are affected by CVE-2026-18331.

Run a Free Instant Scan



Affected Software

Product  Formidable Forms
Category Wordpress Plugins
Vulnerable Domains67,566 live websites (100% of Formidable Forms install base)
Vulnerable Versions
  • from 0 through 6.33.1
Vulnerable Versions Count247 versions ( 100% of all versions)


Common Weakness Enumeration

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')



Details

  • Published - Aug 26, 2026
  • Updated - Aug 26, 2026

Credits

  • daroo (finder)

Website Distribution by Country

Number of websites using CVE-2026-18331
United States30,837 websites


Germany4,897 websites
GB4,632 websites
France4,422 websites
Netherlands2,955 websites
Canada2,856 websites
Australia1,938 websites
Italy1,510 websites
Switzerland1,480 websites
Spain1,178 websites

Website Distribution by TLD

Number of websites using CVE-2026-18331
.com33,050 websites
.org4,827 websites
.co.uk3,086 websites
.de3,034 websites
.nl2,821 websites
.fr2,149 websites
.com.au1,795 websites
.ca1,681 websites
.net1,271 websites
.ch1,253 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-18331

Top websites that are affected by CVE-2026-18331. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
*********.com United States***
****.com United States*,***
**************.com Canada*,***
***.**.**.uk GB*,***
********.com United States*,***
*********************.com United States**,***
************.**.**.uk GB**,***
********.**.**.uk GB**,***
**************.com United States**,***
**********.me United States**,***
See full domain list

FAQ

CVE-2026-18331 is Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Formidable Forms
A total of 67,566 websites have been identified as vulnerable to CVE-2026-18331, based on global website indexing conducted by WebTechSurvey.
The Formidable Forms is affected by the CVE-2026-18331 vulnerability.
Formidable Forms versions up to and including 6.33.1 are vulnerable to CVE-2026-18331.

References