{"id":"CVE-2017-20192","aliases":["EUVD-2017-18910","GHSA-25w9-jxhc-6r43"],"status":"published","title":"Formidable Form Builder \u003c 2.05.03 - Unauthenticated Stored Cross-Site Scripting","description":"The Formidable Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters submitted during form entries like 'after_html' in versions before 2.05.03 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in a victim's browser.","severity":{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-07","score":0.01087,"percentile":0.65508,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-79"],"published":"2024-10-16T06:43:36Z","modified":"2026-06-17T01:15:22Z","exploits":[{"source":"nuclei","id":"CVE-2017-20192","title":"Formidable Forms \u003c 2.05.02 - Cross-Site Scripting","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-20192.yaml"},{"source":"pocgithub","id":"flame-11/CVE-2017-20192-formidable-forms","title":"flame-11/CVE-2017-20192-formidable-forms","date":"2025-12-24","url":"https://github.com/flame-11/CVE-2017-20192-formidable-forms"}],"products":[{"vendor":"strategy11","product":"formidable_form_builder"},{"vendor":"strategy11","product":"formidable_forms"},{"vendor":"strategy11team","product":"formidable forms – contact form plugin, survey, quiz, payment, calculator form \u0026 custom form builder"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/900fcaab-2424-4ae8-af18-95659db0dbe3?source=cve","tags":["Third Party Advisory"]},{"url":"https://klikki.fi/adv/formidable.html","tags":["Exploit","Third Party Advisory"]},{"url":"https://wordpress.org/plugins/formidable/#developers","tags":["Product"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-20192"},{"url":"https://github.com/advisories/GHSA-25w9-jxhc-6r43"}],"sources":{"cve":[{"id":"CVE-2017-20192","title":"Formidable Form Builder \u003c 2.05.03 - Unauthenticated Stored Cross-Site Scripting","description":"The Formidable Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters submitted during form entries like 'after_html' in versions before 2.05.03 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in a victim's browser.","status":"published","published":"2024-10-16T06:43:36.437Z","modified":"2026-04-08T17:06:41.683Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:33:11.59359Z"}],"euvd":[{"id":"EUVD-2017-18910","description":"The Formidable Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters submitted during form entries like 'after_html' in versions before 2.05.03 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in a victim's browser.","status":"published","published":"2024-10-16T06:43:36Z","modified":"2026-04-08T17:06:41Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T19:24:49.380512Z"}],"ghsa":[{"id":"GHSA-25w9-jxhc-6r43","title":"The Formidable Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via...","description":"The Formidable Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters submitted during form entries like 'after_html' in versions before 2.05.03 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in a victim's browser.","status":"published","published":"2024-10-16T09:30:30Z","modified":"2024-10-16T09:30:37Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:58:30.925935Z"}],"nvd":[{"id":"CVE-2017-20192","description":"The Formidable Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters submitted during form entries like 'after_html' in versions before 2.05.03 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in a victim's browser.","status":"published","published":"2024-10-16T07:15:05.147Z","modified":"2026-06-17T01:15:22.53Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:04:21.492973Z"}]}}