Log in Start free

strategy11team

Products

ProductCVEsExploitedLatest
Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder7–Mar 13, 2026
Business Directory Plugin – Easy Listing Directories for WordPress5–Feb 18, 2026
AWP Classifieds1–May 5, 2026
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder1–Oct 30, 2026
Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More1–Aug 26, 2026

Exploited and recent CVEs

  • CVE-2026-89435 High 8.8 Formidable Forms <= 6.35 - Authenticated (Subscriber+) Arbitrary Plugin Installation via 'file_url' Parameter 0.4%
  • CVE-2026-18331 High 7.2 Formidable Forms <= 6.33.1 - Unauthenticated Stored Cross-Site Scripting via 'frm_user_id' Parameter 0.5%
  • CVE-2026-5100 High 7.5 AWP Classifieds <= 4.4.5 - Unauthenticated SQL Injection via 'regions' 0.4%
  • CVE-2026-2888 Medium 5.3 Formidable Forms <= 6.28 - Unauthenticated Payment Amount Manipulation via 'item_meta' Parameter 0.4%
  • CVE-2026-2890 High 7.5 Formidable Forms <= 6.28 - Missing Authorization to Unauthenticated Payment Integrity Bypass via PaymentIntent Reuse 0.3%
  • CVE-2026-1656 Medium 5.3 Business Directory Plugin <= 6.4.20 - Missing Authorization to Unauthenticated Arbitrary Listing Modification 0.4%
  • CVE-2026-2576 High 7.5 Business Directory Plugin <= 6.4.21 - Unauthenticated SQL Injection via payment Parameter 0.5%
  • CVE-2024-13887 Medium 5.3 Business Directory Plugin - Easy Listing Directories for WordPress <= 6.4.14 - Insecure Direct Object Reference to Listing Arbitrary Image Addition 0.3%
  • CVE-2024-11188 Medium 6.1 Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder <= 6.16.1.2 - Reflected Cross-Site Scripting via Custom HTML Form Parameter 0.4%
  • CVE-2024-6725 Medium 4.9 Formidable Forms <= 6.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting 0.4%
  • CVE-2023-5527 High 7.4 Business Directory Plugin <= 6.4.3 - Authenticated (Author+) CSV Injection 0.5%
  • CVE-2024-4443 Critical 9.8 Business Directory Plugin – Easy Listing Directories for WordPress <= 6.4.2 - Unauthenticated SQL Injection via listingfields Parameter 10.4%
  • CVE-2024-0660 Medium 6.1 Formidable Forms <= 6.7.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting 0.2%
  • CVE-2023-6830 Medium 6.5 Formidable Forms <= 6.7 - HTML Injection 0.4%
  • CVE-2023-6842 Medium 4.4 Formidable Forms <= 6.7 - Authenticated (Administrator+) Stored Cross-Site Scripting 0.3%