The Formidable Forms WordPress plugin before version 6.35 fails to sanitize user‑supplied values that are substituted into a form’s custom HTML field. This allows an unauthenticated visitor to inject any shortcode, complete with attacker‑chosen attributes, which is then processed by WordPress’s shortcode parser and executed server‑side on any page that displays the affected form. The outcome is arbitrary server‑side code execution within the WordPress environment, potentially leading to data exfiltration, unauthorized actions, or further compromise.

WordPress sites using the Formidable Forms plugin with a version older than 6.35. No particular operating system or PHP version is specifically mentioned, but any site that hosts the plugin and displays its forms is vulnerable.

The CVSS score of 4.8 indicates moderate severity, while the EPSS score of less than 1% suggests a very low likelihood of exploitation at the time of analysis. The vulnerability is not currently listed in CISA’s KEV catalog, implying no publicly documented exploits. Attackers would need only to craft a request that injects the malicious shortcode into the custom HTML field of an exposed form, and then entice or force users to view the page containing the form. No authentication or privileged access is required to exploit this flaw.