CVE-2026-18331

Executive Summary

CVE-2026-18331 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Formidable Forms WordPress plugin for Contact Forms, Calculators, Quizzes & More in all versions up to and including 6.33.1. The vulnerability allows unauthenticated attackers to inject arbitrary web scripts via the 'frm_user_id' parameter due to insufficient input sanitization and output escaping, with execution occurring automatically when an administrator accesses an affected page. With a CVSS score of 7.2 and high attack complexity metrics favorable to the attacker (network-based, low complexity, no privileges required, no user interaction), this vulnerability presents a significant risk to WordPress sites using the plugin for form-building functionality.

The attack vector is distinctive: by forging the 'frm_user_id' parameter to match an administrator's WordPress user ID — discoverable via the public WordPress REST API — the attacker causes the wp_kses_post() function to act as the sole output filter. This filter preserves the injected payload structurally intact because wp_kses_post() permits a broad set of HTML tags and attributes designed for post content. The plugin's administrative JavaScript subsequently decodes and executes the payload automatically on page load, completing the stored XSS chain. As of this writing, no patch exists, no public exploit code is available, and the vulnerability remains unpatched with a patch confidence of 0/4.

Technical Analysis

Vulnerability Class and Mechanism. CVE-2026-18331 is a Stored Cross-Site Scripting vulnerability (CWE-79) residing in the Formidable Forms plugin's handling of the 'frm_user_id' parameter. The NVD description indicates that the root cause is insufficient input sanitization and output escaping for this parameter. Stored XSS of this nature generally occurs when user-supplied input is persisted to the database and later rendered in a page without proper contextual encoding, allowing the injection of executable script content.

The 'frm_user_id' Parameter Attack Surface. The 'frm_user_id' parameter is used by Formidable Forms to associate form entries with specific WordPress user accounts. The parameter appears to influence which user's perspective or entry data is displayed in the administrative interface. Because the plugin processes this parameter in an administrative context, the stored payload executes within the authenticated administrator's browser session — the highest-privilege web context available in WordPress.

Sanitization Bypass via wp_kses_post(). The critical flaw in the sanitization chain involves the WordPress core function wp_kses_post() being used as the only output filter for the injected content. wp_kses_post() is designed to sanitize HTML for use within a blog post, and as such, it permits a wide range of HTML tags (<a>, <img>, <div>, <span>, etc.) and attributes (including event handlers like onerror, onload, and onmouseover) rather than the more restrictive set typically applied to form parameters or user metadata. When the injected payload passes through wp_kses_post() unaltered (because the payload uses allowed tags/attributes), the structural integrity of the XSS payload is preserved, allowing subsequent JavaScript execution.

JavaScript Decode-and-Execute Chain. The NVD description states that "the plugin's admin JavaScript then decodes and executes it automatically on page load." This indicates that Formidable Forms' administrative scripts process the stored parameter value at runtime — likely by reading the persisted value, decoding it (e.g., via JavaScript decodeURIComponent or similar), and injecting it into the DOM. This decode-and-execute pattern is particularly dangerous because it bypasses server-side protections that might strip or neutralize script content at output time, deferring the final rendering decision to client-side code that may not implement the same level of sanitization.

Attack Prerequisites and Constraint. The attack requires the attacker to know or discover a valid administrator WordPress user ID. The NVD description explicitly notes that these are discoverable via the public WordPress REST API. WordPress exposes user enumeration through endpoints such as /wp-json/wp/v2/users/ which returns user IDs and slugs without authentication (when author archives and REST API are enabled, which is the default configuration). This makes the reconnaissance step trivially simple for unauthenticated attackers.

Affected Scope. The vulnerability affects all versions of Formidable Forms up to and including 6.33.1. No version has been identified as providing a fix, and no patch evidence exists from any tracked source. The affected versions span both the free and premium tiers of the Formidable Forms plugin, as the vulnerable parameter handling is part of the core plugin functionality.

Exploitation Scenarios

Based strictly on the NVD description, the following attack chain is inferred. Note that no public PoC is available, and specific implementation details beyond those in the description are not fabricated.

Scenario 1: Stored XSS Against WordPress Administrator

Step 1 — Reconnaissance/Target Identification: The attacker identifies a WordPress site running Formidable Forms version 6.33.1 or earlier. This can be detected through the site's HTML source (plugin version is often embedded in script/style URLs or meta tags) or via other fingerprinting techniques. The attacker then queries the WordPress REST API to enumerate valid user IDs. The public endpoint /wp-json/wp/v2/users/ (in the implied REST API structure) exposes the user ID of registered users, including administrators, when the default REST API configuration is enabled. The attacker identifies a user ID corresponding to an administrator account.

Step 2 — Triggering the Flaw Class: The attacker crafts an HTTP request to a Formidable Forms processing endpoint that accepts the 'frm_user_id' parameter. The request includes an injected payload — a script or event-handler-bearing HTML fragment — as the parameter value. Because the input sanitization is insufficient, the payload is stored in the WordPress database without being neutralized. The forged 'frm_user_id' value matching the administrator's ID is a critical element: it ensures that the plugin later renders the stored content in the context of that administrator, specifically when the admin views form entries associated with their user ID.

Step 3 — Payload/Execution Method: The stored payload, preserved structurally intact by wp_kses_post() acting as the output filter, is rendered in the WordPress administrative interface when the administrator accesses the affected Formidable Forms page. The plugin's client-side JavaScript decodes the stored value and injects it into the DOM, causing the arbitrary web script to execute automatically in the administrator's browser session. The execution occurs without requiring user interaction, as specified by the CVSS vector (UI:N).

Step 4 — Post-Exploitation Impact: With a stored XSS executing in an administrative context, the attacker can perform any action the administrator can perform. This includes creating new administrator accounts, modifying existing plugins or themes (thereby achieving remote code execution), exfiltrating sensitive data (e.g., form submissions containing PII, user credentials, or business-critical data managed by Formidable Forms), and altering site content for defacement. The CVSS score of 7.2 with scope change indicates that the impact extends beyond the vulnerable component to the entire WordPress installation.

Scenario 2: Mass Campaign via Form-Entry Poisoning

Step 1 — Reconnaissance: An attacker scans for WordPress sites using Formidable Forms at scale, using the Shodan/Google dorks provided in the Metadata section.

Step 2 — Triggering: The attacker automates the injection of malicious 'frm_user_id' parameters across multiple vulnerable sites, threading forged admin IDs into form submission flows.

Step 3 — Execution: When admins log in, the plugin's administrative JavaScript automatically renders and executes the persisted payload. The stored XSS persists until the malicious entries are manually removed.

Step 4 — Impact: Widespread compromise of multiple WordPress installations, potentially used to seed a botnet of compromised admin sessions or to harvest credentials across sites.

Impact Assessment

CVSS Score Analysis. The vulnerability carries a CVSS 3.1 score of 7.2, reflecting the following subscores:

• Attack Vector: Network (AV:N) — Exploitation requires no local access; the attacker can reach the WordPress installation over the network.
• Attack Complexity: Low (AC:L) — No specialized conditions are required beyond the plugin being installed and the default REST API being enabled.
• Privileges Required: None (PR:N) — The attack is fully unauthenticated, which significantly lowers the barrier to entry.
• User Interaction: None (UI:N) — The victim (administrator) does not need to click, hover, or interact with any content; execution is automatic on page load.
• Scope: Changed (S:C) — The impact extends beyond the vulnerable plugin to the entire WordPress installation, including other plugins, themes, and core.
• Confidentiality Impact: Low (C:L) — Information disclosure is limited but possible (e.g., via data exfiltration from the admin context).
• Integrity Impact: Low (I:L) — The attacker can modify data or inject content, though the full blast radius is constrained by the CVSS model.
• Availability Impact: None (A:N) — The vulnerability does not directly cause denial of service.

Business Impact. For enterprises running WordPress with Formidable Forms for business-critical form management (e.g., lead generation, applications, surveys, quotes, quizzes), the impact profile is severe. A successful exploit provides an unauthenticated attacker with a stored XSS payload that executes in an authenticated administrator's session. This serves as a stepping stone to full site takeover — the most common endgame for WordPress XSS targeting admin sessions. Real-world implications include: loss of confidentiality of form submissions (which may contain customer PII, financial data, or health information subject to regulatory compliance like GDPR, CCPA, or HIPAA), loss of site integrity through malicious content injection, and potential supply chain risk if the compromised site serves as a distribution point for further attacks (e.g., watering hole attacks) against site visitors.

Affected Systems. All WordPress installations running Formidable Forms ≤ 6.33.1 are affected. This includes both the free version distributed via the WordPress plugin repository and the premium versions sold via Strategy11's website, as the vulnerable parameter handling exists in the core form-processing module. The plugin's popularity (active installs estimated well over 300,000 based on WordPress repository metrics at the time of analysis) elevates the aggregate risk: even a low-compromise rate across vulnerable site configurations yields a substantial number of compromised sites.

Blast Radius. The plugin is commonly used alongside other security-sensitive components (e.g., e-commerce plugins for quote collection, membership plugins for quiz-based gating, and customer data collection for CRM integration). Consequently, a successful exploit can expose more than just the Formidable Forms data — it can expose the entire site's administrative surface, including other plugin settings, user databases, and stored tokens. The changed scope component confirms this: the impact crosses trust boundaries from the plugin into the host application (WordPress core).

Detection Guidance

The rules below are designed to detect both the reconnaissance phase (REST API user enumeration) and the exploitation phase (injected payloads in 'frm_user_id' parameters, admin-page access after injection).

Sigma Rule

title: Formidable Forms frm_user_id Stored XSS Injection Attempt (CVE-2026-18331)
id: 90aef9d0-5eef-4c20-9e13-2a58d2f8d3c1
status: experimental
description: Detects attempts to exploit Stored XSS via the frm_user_id parameter in Formidable Forms <= 6.33.1
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-18331
author: Valters IT Security Team
date: 2026/06/01
logsource:
    category: webserver
    product: apache
    definition: 'Requirements: access logs with query string logging'
detection:
    selection_http:
        cs-method: 'POST'
        cs-uri-query|contains:
            - 'frm_user_id'
    selection_payload:
        cs-uri-query|contains|all:
            - '<script'
            - 'onerror'
            - 'onload'
            - 'onmouseover'
            - 'javascript:'
            - '&lt;script'
            - '&#x3c;'
    selection_rest_enum:
        cs-uri-stem|contains:
            - '/wp-json/wp/v2/users'
    condition: selection_http and selection_payload
    falsepositives:
        - Legitimate admin configuration using HTML in form metadata
    level: high
    tags:
        - attack.t1190
        - cve.2026-18331
        - cwe.79

YARA Rule

rule Formidable_Forms_frm_user_id_Stored_XSS_CVE_2026_18331 {
    meta:
        author = "Valters IT Security"
        description = "Detects payloads targeting Stored XSS via frm_user_id in Formidable Forms <= 6.33.1"
        cve = "CVE-2026-18331"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-18331"
        date = "2026-06-01"
        score = "70"
    strings:
        $param = "frm_user_id" ascii wide nocase
        $script = "<script" ascii wide nocase
        $event1 = "onerror=" ascii wide nocase
        $event2 = "onload=" ascii wide nocase
        $event3 = "onmouseover=" ascii wide nocase
        $payload1 = "javascript:" ascii wide nocase
        $payload2 = "document.cookie" ascii wide nocase
        $payload3 = "window.location" ascii wide nocase
        $decoded = "decoded" ascii wide nocase
    condition:
        uint16(0) == 0x4D5A or filesize < 1MB and
        $param and 2 of ($script, $event1, $event2, $event3, $payload1, $payload2, $payload3)
}

Suricata IDS Rule

# Formidable Forms frm_user_id Stored XSS Attempt (CVE-2026-18331)
alert http any any -> $HOME_NET any (
    msg:"Formidable Forms frm_user_id Stored XSS Injection Attempt (CVE-2026-18331)";
    content:"frm_user_id"; http_uri; nocase;
    pcre:"/(?:<script|onerror=|<svg|javascript:|onload=)/Ui";
    content:"wp-json/wp/v2/users"; http_uri; nocase;
    sid:1833101; rev:1; classtype:web-application-attack;
    metadata:attack_target Web_Server, created_at 2026_06_01;
    tag:session, cve_2026_18331;
)

Elastic Detection

// EQL rule for CVE-2026-18331 - Formidable Forms frm_user_id stored XSS
any where
  // HTTP request containing frm_user_id parameter (exploitation attempt)
  (event.category == "web" and url.path : "*" and query : "*frm_user_id*" and
   (query : "*<script*" or query : "*onerror=*" or query : "*onload=*" or query : "*javascript:*"))
  OR
  // REST API user enumeration (reconnaissance phase)
  (event.category == "web" and url.path : "/wp-json/wp/v2/users*")
  OR
  // Response containing stored XSS payload in admin pages
  (event.category == "web" and http.response.body : "*frm_user_id*" and
   http.response.body : ("*<script*", "*onerror=*", "*onload=*") and
   url.path : ("/wp-admin/*", "*formidable*"))

Splunk SPL Query

(index=web OR index=apache) sourcetype="access_combined"
| where like(form_data, "%frm_user_id=%")
| eval is_xss=case(
    like(form_data, "%<script%") OR
    like(form_data, "%onerror=%") OR
    like(form_data, "%onload=%") OR
    like(form_data, "%javascript:%") OR
    like(form_data, "%&#x3c;%"), "true",
    1=1, "false")
| where is_xss="true"
| table _time, src_ip, uri, form_data, status
| sort - _time

Wazuh OSSEC Rule

<group name="wordpress,">
  <rule id="183310" level="14">
    <decoded_as>syslog</decoded_as>
    <description>CVE-2026-18331 - Formidable Forms frm_user_id Stored XSS Attempt Detected</description>
    <match>frm_user_id</match>
    <regex>(\&lt;script|\&lt;script|onerror=|onload=|javascript:|&lt;script)</regex>
    <group>web_application_attack,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>

  <rule id="183311" level="8">
    <decoded_as>syslog</decoded_as>
    <description>CVE-2026-18331 - WordPress REST API User Enumeration (wp-json/wp/v2/users)</description>
    <match>/wp-json/wp/v2/users</match>
    <group>recon,</group>
    <if_sid>183310</if_sid>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status: UNPATCHED. Patch confidence is 0/4, indicating no patch evidence from any tracked source. The vendor (Strategy11) has not released a fixed version as of this report.

1) Immediate Mitigations (in priority order):

• Restrict REST API User Exposure: Hide the REST API user enumeration endpoints. Install a security plugin that disables /wp-json/wp/v2/users or restricts it to authenticated users. Alternatively, add the following code to the site's functions.php file (or a custom plugin): add_filter('rest_endpoints', function($endpoints) { if (isset($endpoints['/wp/v2/users'])) { unset($endpoints['/wp/v2/users']); } if (isset($endpoints['/wp/v2/users/(?P<id>[\d]+)'])) { unset($endpoints['/wp/v2/users/(?P<id>[\d]+)']); } return $endpoints; }); — This removes the primary reconnaissance vector for discovering admin user IDs.
• Web Application Firewall (WAF) Rules: Deploy WAF rules that block HTTP requests containing 'frm_user_id' with suspicious script-like content. Use the Suricata rule above as a reference for pattern matching.
• Disable Plugin Admin JavaScript Where Possible: If the site does not require the Formidable Forms admin interface on a continuous basis, restrict access to /wp-admin/ pages housing Formidable Forms to specific IP addresses or require additional authentication (e.g., two-factor authentication) for admin access. The stored XSS only fires when an admin loads the vulnerable page; reducing admin page exposure reduces the attack's triggering probability.
• Content Security Policy (CSP): Implement a strict Content Security Policy header that disallows inline scripts (script-src 'self') and restricts eval() usage. While this may impact legitimate Formidable Forms functionality, it provides a critical last line of defense against injected script execution.

2) Patch/Upgrade Steps:

• Monitor Vendor Channels: Track the WordPress Plugin Repository page for Formidable Forms and the vendor's changelog (strategy11.com). Subscribe to the vendor's security notifications.
• Test Upgrade Candidates: When a patched version (> 6.33.1) is released, test it in a staging environment before production deployment — particularly with respect to 'frm_user_id' handling and admin JavaScript behavior.
• Verify Version After Update: Confirm the installed version reflects the patched build after upgrade.

3) Long-term Hardening:

• Assume Breach Posture: Audit existing form entries for injected content. Query the WordPress database (wp_frm_items and wp_frm_item_metas tables — the implied storage location for form entries) for values containing script tags, event handler attributes, or obfuscated JavaScript.
• Harden WordPress User Enumeration: Disable author archives (author query parameter) and implement server-level rules to block requests to /wp-json/wp/v2/users/.
• Least Privilege: Review administrator accounts and remove unnecessary privileges. Apply the principle of least privilege to all WordPress user roles.
• Regular Plugin Audit: Periodically review installed plugins for known vulnerabilities using a vulnerability scanner (e.g., WPScan). Prioritize remediation of plugins with active unpatched XSS.
• Web Application Security Baseline: Implement a comprehensive web application security program including regular penetration testing, code review of custom modifications, and security-focused configuration hardening (disable XML-RPC if not needed, restrict file editing in admin panel).

References

1. NVD Entry — CVE-2026-18331: https://nvd.nist.gov/vuln/detail/CVE-2026-18331
2. WordPress Plugin Repository — Formidable Forms: https://wordpress.org/plugins/formidable/
3. Vendor Advisory — Strategy11 Changelog (to monitor for future patch): https://strategy11.com/blog/formidable-forms-changelog/
4. CWE-79 — Cross-site Scripting (CWE Dictionary): https://cwe.mitre.org/data/definitions/79.html
5. Wordfence Threat Intelligence (monitoring WordPress plugin vulnerabilities): https://www.wordfence.com/threat-intel/vulnerabilities/

Threat Actor Campaigns / Exploit-in-the-Wild Evidence: As of this report, no known threat actor campaigns or exploit-in-the-wild activity have been publicly documented for CVE-2026-18331. The vulnerability is NOT listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, and no proof-of-concept code or nuclei templates are publicly available. However, given the plugin's prevalence and the unpatched status, active exploitation is considered likely in the near-to-mid term, particularly by opportunistic attackers targeting WordPress at scale. The absence of public PoC does not preclude private exploitation by sophisticated actors.