{"id":"CVE-2026-85641","state":"PUBLISHED","title":"Formidable Forms 6.34 - Unauthenticated Stored Content Injection via 'updated_by' Parameter","description":"The Formidable Forms  WordPress plugin before 6.35 does not restrict who can set the identifier recording which user last edited a form entry, and relies on that identifier when deciding whether to strip HTML from stored entry values, allowing unauthenticated visitors to have markup rendered in the admin entry view that would otherwise be removed, and to attribute their submission to an administrator who never made it.","publishedAt":"2026-09-16T06:00:14.817Z","updatedAt":"2026-09-17T12:35:28.849Z","severity":{"score":4.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","source":"CISA-ADP"},"assigner":"WPScan","products":["Unknown Formidable Forms"],"affected":[{"vendor":"Unknown","product":"Formidable Forms","defaultStatus":"unaffected","versions":[{"version":"6.34","status":"affected","lessThan":"6.35","versionType":"semver"}]}],"references":["https://wpscan.com/vulnerability/99933e4e-e371-4ba4-ad41-6849fcc6a5eb/"],"weaknesses":["CWE-345"],"ingestedAt":"2026-10-29T20:13:15.269Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/85xxx/CVE-2026-85641.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-85641","state":"PUBLISHED","datePublished":"2026-09-16T06:00:14.817Z","dateUpdated":"2026-09-17T12:35:28.849Z","assignerShortName":"WPScan","assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateReserved":"2026-09-04T12:30:24.573Z"},"containers":{"cna":{"title":"Formidable Forms 6.34 - Unauthenticated Stored Content Injection via 'updated_by' Parameter","descriptions":[{"lang":"en","value":"The Formidable Forms  WordPress plugin before 6.35 does not restrict who can set the identifier recording which user last edited a form entry, and relies on that identifier when deciding whether to strip HTML from stored entry values, allowing unauthenticated visitors to have markup rendered in the admin entry view that would otherwise be removed, and to attribute their submission to an administrator who never made it."}],"affected":[{"vendor":"Unknown","product":"Formidable Forms","defaultStatus":"unaffected","versions":[{"version":"6.34","status":"affected","lessThan":"6.35","versionType":"semver"}]}],"references":[{"url":"https://wpscan.com/vulnerability/99933e4e-e371-4ba4-ad41-6849fcc6a5eb/","tags":["exploit","vdb-entry","technical-description"]}],"problemTypes":[{"descriptions":[{"description":"CWE-345 Insufficient Verification of Data Authenticity","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"WPScan","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateUpdated":"2026-09-16T06:00:14.817Z"},"credits":[{"lang":"en","value":"Karthik Ramakrishnan","type":"finder"},{"lang":"en","value":"WPScan","type":"coordinator"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"WPScan CVE Generator"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"timestamp":"2026-09-17T12:18:40.174048Z","id":"CVE-2026-85641","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-345","type":"CWE","lang":"en","description":"CWE-345 Insufficient Verification of Data Authenticity"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-17T12:35:28.849Z"}}]}}}