PLUGIN SECURITY
Is Formidable safe?
The drag and drop WordPress form builder for contact forms, payment forms, calculators, quizzes, surveys, and AI-built web applications.
What this plugin does
- Slug:
formidable - Author: Strategy11 Team
- 300000+ active installs
- 96/100 rating (1385 reviews on wordpress.org)
- 28085875 all-time downloads
- On WordPress.org since 2009-12-12
contact formcustom formform builderformspayment form
Maintenance status
- Latest known version: 6.33.1
- Last updated: 2026-10-16 12:07pm GMT
- Tested up to WordPress: 7.1.3
- Requires PHP: 7.0+
Known vulnerabilities
27 known CVEs on file for Formidable.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-19857 | Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More [formidable] < 6.35 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | Medium 4.8 | < 6.35 | 6.35 | 2026-09-14 | ⚠ update needed |
| CVE-2026-85641 | Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More [formidable] < 6.35 | Insufficient Verification of Data Authenticity | Unknown | < 6.35 | 6.35 | 2026-09-14 | ⚠ update needed |
| CVE-2026-85642 | Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More [formidable] >= 6.5 - < 7.0 | Uncontrolled Resource Consumption | Unknown | 6.5–7.0 | 7.0 | 2026-09-14 | ⚠ update needed |
| CVE-2026-11361 | Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More [formidable] < 6.32.1 | Insufficient Verification of Data Authenticity | Medium 5.9 | < 6.32.1 | 6.32.1 | 2026-08-06 | ✓ fixed in latest |
| CVE-2026-18331 | Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More [formidable] < 6.34 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.2 | < 6.34 | 6.34 | 2026-06-25 | ⚠ update needed |
| CVE-2024-11188 | Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More [formidable] < 6.16.2 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 6.16.2 | 6.16.2 | 2024-11-22 | ✓ fixed in latest |
| CVE-2024-9768 | Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More [formidable] < 6.14.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 4.8 | < 6.14.1 | 6.14.1 | 2024-10-31 | ✓ fixed in latest |
| CVE-2024-6725 | Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More [formidable] < 6.11.2 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 6.11.2 | 6.11.2 | 2024-07-30 | ✓ fixed in latest |
+ 37 more known vulnerabilities
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2024-23522 | Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More [formidable] < 6.7.1 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) | Medium 5.3 | < 6.7.1 | 6.7.1 | 2024-05-17 | ✓ fixed in latest |
| CVE-2024-0660 | Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More [formidable] < 6.8 | Cross-Site Request Forgery (CSRF) | Medium 4.3 | < 6.8 | 6.8 | 2024-01-26 | ✓ fixed in latest |
| CVE-2023-6842 | Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More [formidable] < 6.7.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 4.8 | < 6.7.1 | 6.7.1 | 2024-01-08 | ✓ fixed in latest |
| CVE-2023-6830 | Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More [formidable] < 6.7.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 6.7.1 | 6.7.1 | 2024-01-08 | ✓ fixed in latest |
| — | Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More [formidable] < 6.3.1 | — | Unknown | < 6.3.1 | 6.3.1 | 2023-06-01 | ✓ fixed in latest |
| CVE-2023-2877 | Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More [formidable] < 6.3.1 | Incorrect Authorization | High 8.8 | < 6.3.1 | 6.3.1 | 2023-05-31 | ✓ fixed in latest |
| CVE-2023-1405 | Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More [formidable] < 6.2 | Deserialization of Untrusted Data | High 7.5 | < 6.2 | 6.2 | 2023-04-06 | ✓ fixed in latest |
| CVE-2023-0816 | Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More [formidable] < 6.1 | Authentication Bypass by Spoofing | Medium 6.5 | < 6.1 | 6.1 | 2023-03-06 | ✓ fixed in latest |
| CVE-2023-24419 | Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More [formidable] < 5.5.7 | Cross-Site Request Forgery (CSRF) | High 7.1 | < 5.5.7 | 5.5.7 | 2023-02-01 | ✓ fixed in latest |
| — | Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More [formidable] < 5.5.5 | — | Unknown | < 5.5.5 | 5.5.5 | 2022-12-21 | ✓ fixed in latest |
| — | Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More [formidable] < 5.5.5 | — | Unknown | < 5.5.5 | 5.5.5 | 2022-12-21 | ✓ fixed in latest |
| CVE-2022-45806 | Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More [formidable] < 5.5.5 | Missing Authorization | Medium 4.3 | < 5.5.5 | 5.5.5 | 2022-12-16 | ✓ fixed in latest |
| — | Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More [formidable] < 5.5.5 | — | Unknown | < 5.5.5 | 5.5.5 | 2022-12-16 | ✓ fixed in latest |
| CVE-2021-39330 | Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More [formidable] < 5.0.07 | — | Unknown | < 5.0.07 | 5.0.07 | 2021-10-13 | ✓ fixed in latest |
| CVE-2021-24608 | Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More [formidable] < 5.0.07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 4.8 | < 5.0.07 | 5.0.07 | 2021-10-06 | ✓ fixed in latest |
| CVE-2021-24884 | Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More [formidable] < 4.09.05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Critical 9.6 | < 4.09.05 | 4.09.05 | 2021-01-28 | ✓ fixed in latest |
| CVE-2019-15780 | Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More [formidable] < 4.02.01 | Deserialization of Untrusted Data | Critical 9.8 | < 4.02.01 | 4.02.01 | 2019-08-09 | ✓ fixed in latest |
| — | Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More [formidable] < 2.05.03 | — | Unknown | < 2.05.03 | 2.05.03 | 2017-11-20 | ✓ fixed in latest |
| — | Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More [formidable] < 2.05.03 | — | Unknown | < 2.05.03 | 2.05.03 | 2017-11-20 | ✓ fixed in latest |
| — | Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More [formidable] < 2.05.03 | — | Unknown | < 2.05.03 | 2.05.03 | 2017-11-20 | ✓ fixed in latest |
| — | Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More [formidable] < 2.05.03 | — | Unknown | < 2.05.03 | 2.05.03 | 2017-11-13 | ✓ fixed in latest |
| CVE-2017-20192 | Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More [formidable] < 2.05.03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 8.3 | < 2.05.03 | 2.05.03 | 2017-11-13 | ✓ fixed in latest |
| — | Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More [formidable] < 2.05.03 | — | Unknown | < 2.05.03 | 2.05.03 | 2017-11-13 | ✓ fixed in latest |
| CVE-2017-20194 | Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More [formidable] < 2.05.03 | Exposure of Sensitive Information to an Unauthorized Actor | Medium 5.3 | < 2.05.03 | 2.05.03 | 2017-11-12 | ✓ fixed in latest |
| — | Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More [formidable] < 2.0.22 | — | Unknown | < 2.0.22 | 2.0.22 | 2016-02-16 | ✓ fixed in latest |
| — | Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More [formidable] < 1.06.04 | — | Unknown | < 1.06.04 | 1.06.04 | 2016-01-29 | ✓ fixed in latest |
| — | Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More [formidable] < 1.06.09 | — | Unknown | < 1.06.09 | 1.06.09 | 2016-01-29 | ✓ fixed in latest |
| CVE-2009-4140 | Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More [formidable] < 1.06.03 | — | Unknown | < 1.06.03 | 1.06.03 | 2009-12-22 | ✓ fixed in latest |
| CVE-2014-9309 | Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More [formidable] < 2.0 | — | Unknown | < 2.0 | 2.0 | 0000-00-00 | ✓ fixed in latest |
| — | Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More [formidable] < 6.29 | — | Unknown | < 6.29 | 6.29 | 0000-00-00 | ✓ fixed in latest |
| — | Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More [formidable] < 6.29 | — | Unknown | < 6.29 | 6.29 | 0000-00-00 | ✓ fixed in latest |
| — | Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More [formidable] < 2.05.03 | — | Unknown | < 2.05.03 | 2.05.03 | — | ✓ fixed in latest |
| — | Formidable Forms < 2.05.03 - Multiple Vulnerabilities | — | Unknown | < 2.05.03 | 2.05.03 | — | ✓ fixed in latest |
| CVE-2023-24419 | Formidable Forms < 5.5.7 - Arbitrary Entry Deletion via CSRF | — | Unknown | < 5.5.7 | 5.5.7 | — | ✓ fixed in latest |
| CVE-2023-2877 | Formidable Forms < 6.3.1 - Subscriber+ Remote Code Execution | — | Unknown | < 6.3.1 | 6.3.1 | — | ✓ fixed in latest |
| CVE-2026-2888 | Formidable Forms < 6.29 - Unauthenticated Payment Amount Manipulation via 'item_meta' Parameter | — | Unknown | < 6.29 | 6.29 | — | ✓ fixed in latest |
| CVE-2026-2890 | Formidable Forms < 6.29 - Unauthenticated Payment Integrity Bypass via PaymentIntent Reuse | — | Unknown | < 6.29 | 6.29 | — | ✓ fixed in latest |
How to fix it
Keep Formidable updated — 6.33.1 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- Contact Form 7 — 10000000+ active installs — 80/100 (2183) — max PHP 8.4
- Akismet Anti-spam: Spam Protection — 5000000+ active installs — 94/100 (1187) — max PHP 8.4
- WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More — 5000000+ active installs — 96/100 (14385)
- Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder — 800000+ active installs — 96/100 (806) — max PHP <8.0
- Forminator Forms – Contact Form, Payment Form & Custom Form Builder — 600000+ active installs — 96/100 (2139)
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.