CVE-2026-85641 — MEDIUM (4.3)

Vulnerability Description

The Formidable Forms WordPress plugin before 6.35 does not restrict who can set the identifier recording which user last edited a form entry, and relies on that identifier when deciding whether to strip HTML from stored entry values, allowing unauthenticated visitors to have markup rendered in the admin entry view that would otherwise be removed, and to attribute their submission to an administrator who never made it.

CVSS Score

4.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality

NONE

Integrity

LOW

Availability

NONE

Related Weaknesses (CWE)

CWE-345

References

https://wpscan.com/vulnerability/99933e4e-e371-4ba4-ad41-6849fcc6a5eb/

FAQ

What is CVE-2026-85641?

CVE-2026-85641 is a vulnerability with a CVSS score of 4.3 (MEDIUM). The Formidable Forms WordPress plugin before 6.35 does not restrict who can set the identifier recording which user last edited a form entry, and relies on that identifier when deciding whether to st...

How severe is CVE-2026-85641?

CVE-2026-85641 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-85641?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.