WordPress Vulnerability Scanner WPSec
Vulnerabilities / Fluent Forms

Fluent Forms vulnerabilities

Advisories WPSec published for Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder. Other sources may list more. Its attack surface: Fluent Forms on WPSec AttackSurface.

PublishedIDVulnerabilitySeverityFixed in
2026-10-17 WPSEC-2026-1193 Fluent Forms <= 6.2.15 - Unauthenticated Payment Bypass via Oversized Payment Amounts, Quantities and Checkbox Values Medium 5.3 6.2.16
2026-10-17 WPSEC-2026-1192 Fluent Forms <= 6.2.15 - Unauthenticated Insecure Direct Object Reference via Guest Order Payer Email Medium 6.5 6.2.16
2026-10-17 WPSEC-2026-1191 Fluent Forms <= 6.2.15 - Authenticated (Contributor+) Sensitive Information Exposure via 'theme' Shortcode Attribute Medium 4.3 6.2.16
2026-10-17 WPSEC-2026-1190 Fluent Forms <= 6.2.15 - Authenticated (Fluent Forms Manager+) Cross-Form Authorization Bypass via Malformed 'form_id' Route Parameter Medium 6.3 6.2.16
2026-10-01 WPSEC-2026-0187 Fluent Forms <= 6.2.13 - Authenticated (Fluent Forms Manager+) Sensitive Information Exposure via Global Settings Endpoint Medium 4.9 6.2.14
2026-10-01 WPSEC-2026-0186 Fluent Forms <= 6.2.13 - Authenticated (Fluent Forms Manager+) Stored Cross-Site Scripting via Form Field Attributes and Payment Option Labels Medium 6.4 6.2.14
2026-10-01 WPSEC-2026-0185 Fluent Forms <= 6.2.13 - Authenticated (Fluent Forms Manager+) Cross-Form Entry Modification, Deletion and Disclosure via 'entry_id' Parameter Medium 4.7 6.2.14
2026-10-01 WPSEC-2026-0184 Fluent Forms <= 6.2.13 - Unauthenticated Payment Amount Manipulation via Omitted Payment Inputs and Negative Custom Subscription Amounts Medium 5.3 6.2.14
2026-10-01 WPSEC-2026-0183 Fluent Forms <= 6.2.13 - Authenticated (Fluent Forms Manager+) Sensitive Information Exposure via Embedded Post Author Smartcodes Medium 4.9 6.2.14
2026-10-01 WPSEC-2026-0007 Fluent Forms <= 6.2.14 - Unauthenticated Payment Bypass via Zero or Invalid Payment Values Medium 5.3 6.2.15
2026-10-01 WPSEC-2026-0006 Fluent Forms <= 6.2.14 - Unauthenticated Reflected Cross-Site Scripting via 'get' Smartcode Medium 6.1 6.2.15
2026-10-01 WPSEC-2026-0005 Fluent Forms <= 6.2.14 - Authenticated (Fluent Forms Manager+) Stored Cross-Site Scripting via Payment Item 'price_label' and Payment Summary 'cart_empty_text' Settings Medium 4.8 6.2.15
2026-10-01 WPSEC-2026-0004 Fluent Forms <= 6.2.14 - Authenticated (Fluent Forms Manager+) Sensitive Information Exposure via User Search Low 2.7 6.2.15

License: CC BY 4.0