CVE-2023-6830: The Formidable Forms plugin for WordPress is vulnerable to HTML injection in versions up to, and including, 6.7. This vulnerability allows unauthenticated users to inject arbitrary HTML code into form

medium Affects formidable (WordPress plugin). Feed 2026.10.29.3, updated 2026-10-29; published 2024-01-09; advisory modified 2026-06-17.

The Formidable Forms plugin for WordPress is vulnerable to HTML injection in versions up to, and including, 6.7. This vulnerability allows unauthenticated users to inject arbitrary HTML code into form

Package: formidable (WordPress plugin) WordPress
Affected versions: <=6.7
Fixed in: no fix recorded
Severity: medium CVSS 6.5
Exploitation: not on CISA KEV · EPSS 0% (33.0th percentile)
Published: 2024-01-09
Source: nvd

References

CWE-79

NVD record formidable (WordPress plugin) advisories

Am I affected?

Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# PHP projects (recommended)
composer require --dev phpwarden/phpwarden
# then
vendor/bin/phpwarden wordpress /var/www/html

# or, without Composer
pipx install phpwarden   &&   phpwarden wordpress /var/www/html

Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.

Install docs How findings are ranked

Related advisories

CVE-2019-15780 critical The formidable plugin before 4.02.01 for WordPress has unsafe deserialization. same package: formidable (WordPress plugin)
CVE-2017-20192 high The Formidable Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Script same package: formidable (WordPress plugin)
CVE-2017-17780 medium The Clockwork SMS clockwork-test-message.php component has XSS via a crafted "to" paramete same package: formidable (WordPress plugin)
CVE-2024-11188 medium The Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custo same package: formidable (WordPress plugin)
CVE-2024-6725 medium The Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custo same package: formidable (WordPress plugin)
CVE-2023-6842 medium The Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form same package: formidable (WordPress plugin)