CVE-2017-20192

HIGHNuclei

Formidable Form Builder < 2.05.03 - Unauthenticated Stored Cross-Site Scripting

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2017-20192 has a selected CVSS score of 8.3 (high); EIP currently links 1 repository PoC, 1 Nuclei template, and 1 lab environment.

Description

The Formidable Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters submitted during form entries like 'after_html' in versions before 2.05.03 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in a victim's browser.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Oct 15, 2024 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Repository PoCs
1
Nuclei templates
1
Lab environments
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Oct 16, 2024 · Source: CVE List

Affected products and versions

3
ProductSourceVersion range

Formidable Form Builder plugin for WordPress

Browse strategy11 / Formidable Form Builder plugin for WordPress
VulnCheckVersion data not supplied

formidable_forms

Browse strategy11 / formidable_forms

Default status: unknown

CVE ListBefore 2.05.03affected

Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder

Browse strategy11team / Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder

Default status: unaffected

CVE ListBefore 2.05.03affected

Proofs of concept

1

Repository PoCs

GitHubflame-11/CVE-2017-20192-formidable-formsRepository PoCby flame-110Scanner5 files

10.3 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Bash script that validates the presence of CVE-2017-20192 (stored XSS) by submitting a crafted payload to a Formidable Forms instance and then checking an admin view for the injected script marker. It does not deliver the payload to a victim's browser.

Backdoor review

No backdoor observed in reviewed code

The PoC consists of a README and a bash script that automates reproduction of CVE-2017-20192 (stored XSS). The script submits a crafted form entry, logs in as admin, and checks for the XSS payload in the admin view. No backdoor, deceptive payload, or concealed operator-directed harm is present.

ClassificationScanner
Model confidence95%
AuthenticationNot required
LanguagesBashPython
Target softwareFormidable Form Builder (WordPress plugin)
Attack typesStored Cross-Site Scripting (XSS)
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script's primary operation is to detect and report the presence of the vulnerability by checking for a stored marker in an admin view. It does not deliver the payload to a victim browser or perform any action beyond validation. The README explicitly describes it as a 'helper script' that 'checks for the stored marker'.

README.md:16-19scripts/poc.sh:83-88

Requirements

  • A running instance of the vulnerable Formidable Forms plugin (< 2.05.03) with a form identified by the key 'cve-2017-20192'.README.md:3scripts/poc.sh:7
  • Network access to the target WordPress instance.scripts/poc.sh:4

Observed behavior

  • Fetches the form preview HTML to extract form_id, form_key, and field_id.scripts/poc.sh:36-43
  • Submits an unauthenticated POST request containing a crafted XSS payload to the form entry endpoint.scripts/poc.sh:54-58
  • Logs in as a WordPress administrator and fetches the admin entry view for the submitted form.scripts/poc.sh:60-81
  • Checks the admin entry view HTML for the presence of the injected script marker and reports 'VULNERABLE' or 'NOT VULNERABLE'.scripts/poc.sh:83-88
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Script Behavior
Payload withheldThe script's actions are entirely consistent with a legitimate PoC for the stated CVE. It does not exfiltrate data, establish persistence, or perform any unrelated actions.scripts/poc.sh:20-30scripts/poc.sh:55-58scripts/poc.sh:83-84
Review boundaries

What the analysis did not establish

  • Evidence coverage is incomplete: 3 of 5 files in the repository were omitted from the packet, and complete_artifact_coverage is false.
  • The analysis is based solely on static review of the provided source code; the script was not executed, and its behavior in a live environment is not confirmed.
  • Three files (total 5) were omitted from the text evidence; their metadata indicates they are not analyzed, but their content is unavailable for review.
  • Binary files were flagged as metadata-only and not analyzed, though none were reported in this packet.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

1
GitHub

docker-compose.yml

flame-11/CVE-2017-20192-formidable-formsCreated Vuln labCVE-2017-20192Compose · images

1 Compose manifest · 3 services

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment that deploys a MySQL database, a WordPress 5.2.3 instance with Apache, and a one-shot CLI container that installs the Formidable Forms plugin (version 2.05.02) and configures a test form. The environment is designed to reproduce CVE-2017-20192, a stored XSS vulnerability in Formidable Forms.

docker-compose.yml:1-51README.md:1-3

Lab assessment

Vulnerability lab

The README explicitly states the repository is a 'Reproducible Docker lab for CVE-2017-20192'. The Compose file deploys a specific vulnerable version of Formidable Forms (2.05.02) and includes a proof-of-concept script (poc.sh) that demonstrates the stored XSS.

README.md:1-3docker-compose.yml:37scripts/poc.sh:1-90
Lab shapeCompose · images
Services3
Compose manifests1
Dockerfiles0
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

db

database

MySQL 5.7.44 database service that stores WordPress data. It is configured with a database named 'wordpress' and credentials for the WordPress user.

docker-compose.yml:4-11

wordpress

web applicationvulnerable target

WordPress 5.2.3 with Apache, exposing port 18080 on the host. It depends on the db service and uses the wp_data volume for persistent files. The Formidable Forms plugin (version 2.05.02) is installed by the wp-init service, making this the target for the stored XSS vulnerability.

docker-compose.yml:13-25scripts/wp-init.sh:47-57

wp-init

initializationplugin installerform creator

A one-shot WordPress CLI container that runs as root (user 0:0). It waits for the database and WordPress, installs WordPress if needed, downloads and activates Formidable Forms 2.05.02 from the official WordPress plugin repository, creates a test form with key 'cve-2017-20192', and publishes a page embedding the form. It also fixes ownership of wp-content for the www-data user.

docker-compose.yml:27-46scripts/wp-init.sh:1-153

poc.sh

proof-of-concept exploit

A bash script that demonstrates the stored XSS vulnerability. It submits a crafted entry containing an SVG payload to the Formidable form without authentication, logs in as the WordPress admin, and checks the admin entry view for the executed payload marker.

scripts/poc.sh:1-90
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2017-20192

Supported by supplied evidence

The environment explicitly targets CVE-2017-20192 by deploying Formidable Forms 2.05.02, which is below the fixed version 2.05.03. The poc.sh script demonstrates a stored XSS attack by injecting an SVG payload into a form entry and verifying its execution in the admin view, consistent with the CVE description.

README.md:1-3docker-compose.yml:37scripts/poc.sh:1-90
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed to run the environment.README.md:7-9
  • The lab expects the WordPress admin credentials (admin/admin) and the target URL (http://127.0.0.1:18080) as configured in the Compose file.docker-compose.yml:33-36

Evidence-described exercise path

  1. Start the lab environment with 'docker compose up -d --build'.README.md:7-9
  2. Run the proof-of-concept script 'bash ./scripts/poc.sh' to submit a crafted entry and verify the stored XSS.README.md:17-19
  3. The poc.sh script submits an unauthenticated entry with an SVG payload, logs in as admin, and checks the admin entry view for the marker.scripts/poc.sh:1-90
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at the lab's own target (the WordPress/Formidable instance). The poc.sh script only interacts with the local lab services on 127.0.0.1:18080, and the wp-init.sh script downloads the Formidable plugin from the official WordPress repository and configures the lab. There is no evidence of host escape, external connections beyond the lab, persistence outside the lab, credential theft, or destructive actions.

scripts/poc.sh:1-90scripts/wp-init.sh:1-153docker-compose.yml:1-51
Review boundaries

What the analysis did not establish

  • The .gitignore file is not included in the evidence, but its absence does not affect the analysis.
  • The packet does not include the actual Formidable plugin zip file; it is downloaded at runtime from the official WordPress repository, which is a standard lab initialization step.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Nuclei templates

1
ProjectDiscoveryMEDIUMFormidable Forms < 2.05.02 - Cross-Site ScriptingCVSS 6.1

Formidable Form Builder for WordPress versions before 2.05.03 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in form parameters like 'after_html', letting unauthenticated attackers inject and execute arbitrary scripts in victims' browsers

Impact

Attackers can execute arbitrary scripts in users' browsers, potentially leading to session hijacking, defacement, or redirection.

Remediation

Update to version 2.05.03 or later.

WeaknessesCWE-79
Authors0xanis
Template tagscvecve2017wordpresswp-pluginformidablexssreflectedvkev
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:strategy11:formidable_forms:*:*:*:*:*:wordpress:*:*
FOFA: body="formidable" && body="wp-content/plugins"
Google: inurl:"wp-content/plugins/formidable"
https://klikki.fi/formidable-forms-vulnerabilities/ https://wordpress.org/plugins/formidable/ https://nvd.nist.gov/vuln/detail/CVE-2017-20192

Source: ProjectDiscovery

References

4