CVE-2025-13748

The Fluent Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 6.2.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This allows authenticated attackers with Custom-level access and above to read private form submissions, change submission statuses, permanently delete submissions, and modify global plugin settings.

The Fluent Forms plugin for WordPress up to version 6.2.14 is vulnerable to Reflected Cross-Site Scripting via the 'any attacker-chosen name matching the {get.NAME} placeholder' parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute if they can trick a user into clicking a link. Exploitation requires a site administrator to have configured a Custom HTML field on a published form containing a {get.*} SmartCode inside a URL-accepting attribute such as iframe src or a href.

The Fluent Forms plugin for WordPress (versions up to 6.2.11) is vulnerable to Stored Cross-Site Scripting via Notification Smartcode Values. Unauthenticated attackers can inject arbitrary web scripts that execute in the browser of an administrator when viewing submission logs. Exploitation requires configured email notifications with attacker-influenced Smartcode values.

The Fluent Forms plugin for WordPress up to version 6.2.8 contains a Reflected Cross-Site Scripting (XSS) vulnerability via the 'param' parameter. Unauthenticated attackers can inject arbitrary web scripts that execute if they trick a user into clicking a link.

The Fluent Forms plugin for WordPress up to version 6.2.8 is vulnerable to Insecure Direct Object Reference (IDOR) via the 'transaction' parameter. Missing validation on a user-controlled key allows unauthenticated attackers to brute-force valid transaction hashes and view sensitive payment receipt data including customer name, email, billing address, order items, payment method, and payment status of other users.

The Fluent Forms WordPress plugin before 6.2.6 does not sanitize and escape one of its form field configuration settings before outputting it inside an inline script when a form is rendered. Users with a role as low as Contributor (with delegated form-management permission, but lacking unfiltered_html, e.g., in a multisite setup) can perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor who loads the form, including administrators previewing it.

The Fluent Forms plugin for WordPress up to version 6.2.7 has a Stored XSS vulnerability via the Name field nested in `password`. An unauthenticated attacker can inject arbitrary JavaScript that executes when a user views the page.

The Fluent Forms plugin for WordPress up to version 6.2.1 contains an incorrect authorization vulnerability in the 'subscription_id' parameter. Insufficient ownership checks in the AJAX payment cancellation flow allow authenticated attackers with subscriber-level access or higher to cancel other users' subscriptions.

The Fluent Forms WordPress plugin before version 6.2.5 does not properly restrict the deletion of form submission entries to the forms a restricted Manager is authorized to manage. This allows a Manager limited to specific forms to permanently delete submission entries belonging to other forms. This requires a non-default configuration where an administrator has created at least one Manager restricted to specific forms.

The Fluent Forms WordPress plugin before version 6.2.1 does not properly verify ownership before processing a subscription cancellation request, allowing authenticated users with low privileges to cancel subscriptions belonging to other users.