CVE-2023-6830

CWE-79 — Cross-site Scripting (XSS)5 documents5 sources
Severity
6.1MEDIUM
EPSS
0.5%
top 33.88%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Strategy11 Formidable Form Builder
Timeline
PublishedJan 9
Latest updateApr 11

Description

The Formidable Forms plugin for WordPress is vulnerable to HTML injection in versions up to, and including, 6.7. This vulnerability allows unauthenticated users to inject arbitrary HTML code into form fields. When the form data is viewed by an administrator in the Entries View Page, the injected HTML code is rendered, potentially leading to admin area defacement or redirection to malicious websites. CVE-2024-23522 appears to be a duplicate of this issue.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NExploitability: 3.9 | Impact: 2.5

Affected Packages1 packages

🔴Vulnerability Details

3
VulDB
Formidable Forms Plugin up to 6.7 on WordPress cross site scripting↗2026-04-11
▶
GHSA
GHSA-p2gq-hc84-24mm: The Formidable Forms plugin for WordPress is vulnerable to HTML injection in versions up to, and including, 6↗2024-01-09
▶
CVEList
Formidable Forms <= 6.7 - HTML Injection↗2024-01-09
▶

💥Exploits & PoCs

1
Exploit-DB
PHPMyAdmin 3.0 - Bruteforce Login Bypass↗2025-08-18
▶