{"schemaVersion":3,"id":"CVE-2026-85641","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"The Formidable Forms  WordPress plugin before 6.35 does not restrict who can set the identifier recording which user last edited a form entry, and relies on that identifier when deciding whether to strip HTML from stored entry values, allowing unauthenticated visitors to have markup rendered in the admin entry view that would otherwise be removed, and to attribute their submission to an administrator who never made it.","dates":{"published":"2026-09-16T06:00:14.817Z","modified":"2026-09-17T12:35:28.849Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":5.3,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"wordfence","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":4.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":4.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"wordfence","score":5.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00142,"percentile":0.03144,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0.009000000000000001,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.00133},"history":[{"date":"2026-09-16T00:00:00.000Z","score":0.00123,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00123,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00133,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00133,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00133,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00133,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00133,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00133,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00142,"percentile":0.03144}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.00133,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00133,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00133,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00133,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00142,"percentile":0.03144}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"REF_D540D037F6022C9D","name":"Exploit Reference (wpscan.com)","source":"reference","url":"https://wpscan.com/vulnerability/99933e4e-e371-4ba4-ad41-6849fcc6a5eb/","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-345","name":"Insufficient Verification of Data Authenticity","description":"The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.","type":"weakness","status":"Draft","abstraction":"Class","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/345.html"},{"id":"CWE-20","name":"Improper Input Validation","description":"The product receives input or data, but it does\n        not validate or incorrectly validates that the input has the\n        properties that are required to process the data safely and\n        correctly.","type":"weakness","status":"Stable","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/20.html"}],"affected":[{"vendor":"unknown","product":"formidable forms","name":"Formidable Forms","label":"formidable forms","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 6.34, < 6.35","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 6.34, < 6.35","eol":null,"hubHref":"/vendor/unknown/formidable_forms"},{"vendor":"wordpress","product":"formidable","name":"Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More","label":"formidable","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 6.34 (fixed in 6.35)","noFixRecorded":false,"fixedIn":"6.35"}],"versionsText":"≤ 6.34 (fixed in 6.35)","eol":null,"hubHref":null}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://wpscan.com/vulnerability/99933e4e-e371-4ba4-ad41-6849fcc6a5eb/","label":"wpscan.com/vulnerability/99933e4e-e371-4ba4-ad41-6849fcc6a5eb/","hostname":"wpscan.com","tags":["Exploit","VDB Entry","Technical Description"]},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61499424-0002-4e17-81cf-468350e13e20","label":"www.wordfence.com/threat-intel/vulnerabilities/id/61499424-0002-4e17-81cf-468350e13e20","hostname":"www.wordfence.com","tags":["Vendor Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-09-16T06:00:14.817Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-09-17T12:35:28.849Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":31,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T11:30:13.914Z","stale":false,"partial":false}}