The Formidable Forms WordPress plugin is vulnerable to a stored XSS flaw that permits an unauthenticated attacker to embed arbitrary JavaScript in the plugin’s form entries. By supplying a forged frm_user_id value matching an administrator’s user ID, the plugin’s entry processor fails to sanitize the payload; when an administrator views the affected page the injected code runs with the admin’s browser context. Based on the description, it is inferred that the attacker could potentially steal credentials, hijack sessions, or deface the site. The weakness is an input‑validation flaw listed as CWE‑79.

All installations of the Formidable Forms WordPress Plugin with versions up to and including 6.33.1 are affected. The vulnerability is present on any WordPress site using this plugin; the specific version numbers are 6.33.1 and older. No other vendors or products are mentioned as affected.

The CVSS score of 7.2 indicates a high impact with remote impact and high attack complexity. Although the EPSS score is not available, the exploit can be performed without authentication and only requires ability to craft a malicious form entry; based on the description, it is inferred that the exploit is likely feasible for attackers with basic skill. The vulnerability is not listed in the CISA KEV catalog. Attackers can use the public WordPress REST API to discover administrator IDs and then inject payloads that are stored and executed on subsequent page loads by administrators.