Fluent Forms <= 6.2.13 - Authenticated (Fluent Forms Manager+) Stored Cross-Site Scripting via Form Field Attributes and Payment Option Labels
- ID
- WPSEC-2026-0186
- Plugin
- Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder (fluentform)
- Affected
- all versions before 6.2.14
- Remediation
- Update to 6.2.14 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin High · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- Fluent Forms on WPSec AttackSurface
- Fix released
- Published
Description
The Fluent Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form field attributes, subscription plan names and custom amount labels, and pricing option labels in all versions up to, and including, 6.2.13. This is due to insufficient input sanitization and output escaping in both the form editor and the form import feature: event-handler attribute keys such as onfocus were kept, and these labels were output without escaping. This makes it possible for authenticated users who have been granted form management access but lack the unfiltered_html capability to inject arbitrary web scripts. These scripts run whenever a user views the affected form.
References
- https://wpsec.com/vuln/WPSEC-2026-0186/
- https://plugins.svn.wordpress.org/fluentform/tags/6.2.14/
- https://wordpress.org/plugins/fluentform/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS