Formidable Forms Vulnerability – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder – Authenticated (Administrator+) Stored Cross-Site Scripting – CVE-2023-6842 | WordPress Plugin Vulnerability Report 

Plugin Name: Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder

Key Information:

  • Software Type: Plugin
  • Software Slug: formidable
  • Software Status: Active
  • Software Author: sswells
  • Software Downloads: 19,370,348
  • Active Installs: 300,000
  • Last Updated: January 8, 2024
  • Patched Versions: 6.7.1
  • Affected Versions: <= 6.7

Vulnerability Details:

  • Name: Formidable Forms <= 6.7
  • Title: Authenticated (Administrator+) Stored Cross-Site Scripting
  • Type: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
  • CVE: CVE-2023-6842
  • CVSS Score: 4.4
  • Publicly Published: January 8, 2024
  • Researcher: drop
  • Description: The Formidable Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the name field label and description field label parameter in versions up to 6.7. This is due to insufficient input sanitization and output escaping. Attackers with administrator-level access can inject arbitrary web scripts into pages, which will execute for users accessing an injected page. This primarily affects multi-site installations and sites where unfiltered_html is disabled. Additionally, the Formidable settings allow admins to extend form creation and management permissions to other user types, potentially broadening the vulnerability's impact.


The Formidable Forms plugin for WordPress has a vulnerability in versions up to and including 6.7 that allows authenticated attackers with administrator-level access to execute Stored Cross-Site Scripting attacks. This vulnerability has been patched in version 6.7.1.

Detailed Overview:

This vulnerability, discovered by a researcher known as drop, presents a significant risk, especially in multi-site installations and in environments where the unfiltered_html capability is disabled. By exploiting the name field label and description field label parameters, attackers can inject harmful scripts that are executed when a user accesses the affected page. While the risk is inherently limited to users with administrator access, the plugin's settings could potentially extend dangerous permissions to lower-level users, amplifying the risk of exploitation.

Advice for Users:

  • Immediate Action: Users should update to the patched version 6.7.1 immediately.
  • Check for Signs of Vulnerability: Regularly review your site for unexpected script executions or altered form behaviors.
  • Alternate Plugins: While the issue has been addressed, consider alternate plugins offering similar functionalities if security concerns persist.
  • Stay Updated: Consistently update all plugins to their latest versions to mitigate vulnerability risks.


The swift resolution of this vulnerability by the Formidable Forms developers highlights the critical need for ongoing vigilance and timely updates in WordPress plugin management. To ensure the security of WordPress installations, users are advised to upgrade to version 6.7.1 or later.



In the fast-paced world of digital technology, the security of a WordPress site can often be overlooked, especially by small business owners juggling numerous responsibilities. The discovery of the CVE-2023-6842 vulnerability in the widely used Formidable Forms plugin serves as a critical reminder of the importance of constant vigilance in website security. This vulnerability not only highlights the challenges of maintaining a secure online presence but also underscores the need for proactive measures to protect against evolving cyber threats.

About the Plugin:

Formidable Forms – a popular WordPress plugin used by over 300,000 websites – is known for its versatility in creating forms ranging from simple contact forms to complex surveys and quizzes. Developed by sswells, this plugin has been a cornerstone for many businesses, facilitating user interactions and data collection. Despite its popularity and utility, Formidable Forms has encountered its share of security challenges, including 16 vulnerabilities since January 26, 2016.

Details of the Vulnerability:

The recent vulnerability, identified as CVE-2023-6842, is classified as Authenticated (Administrator+) Stored Cross-Site Scripting. It affects versions of the plugin up to 6.7 and involves insufficient input sanitization and output escaping in the name and description field labels. This flaw allows attackers with administrator-level access to inject harmful scripts, which are executed when users access an injected page. The vulnerability poses a particular risk to multi-site installations and sites where unfiltered_html is disabled.

Risks and Potential Impacts:

The implications of this vulnerability are significant. Malicious scripts injected through this exploit can compromise website integrity, potentially leading to data breaches, unauthorized access to sensitive information, or damaging the site's reputation. For a small business, such incidents can have far-reaching consequences, including loss of customer trust and financial repercussions.

Remediation Steps:

The immediate action required is updating the Formidable Forms plugin to the patched version 6.7.1. Users should also review their site for any unexpected script executions or alterations in form behaviors. Considering alternative plugins with similar functionalities might be prudent for those still concerned about security.

History of Previous Vulnerabilities:

With 16 previous vulnerabilities recorded since 2016, the Formidable Forms plugin's history underscores the ever-present nature of security risks in software. Each vulnerability has presented unique challenges, reinforcing the need for continuous monitoring and updating of all website components.


The prompt response by Formidable Forms' developers to patch CVE-2023-6842 highlights the critical importance of timely software updates in mitigating security risks. For small business owners, regularly updating WordPress plugins might seem daunting amidst their myriad responsibilities. However, neglecting this aspect can leave their websites vulnerable to attacks. Employing automated update features, scheduling regular check-ups, or partnering with a managed service provider can significantly reduce the burden while ensuring the security of their online presence. In the digital world, staying informed and proactive about security vulnerabilities is not just a best practice; it's a necessity for safeguarding your business's digital doorstep.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

Formidable Forms Vulnerability – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder – Authenticated (Administrator+) Stored Cross-Site Scripting – CVE-2023-6842 | WordPress Plugin Vulnerability Report FAQs

Leave a Comment