CVE-2026-103343
MediumCVSS 6.5Summary
FluentForm plugin has a stored XSS vulnerability due to improper input neutralization during web page generation. Affects versions up to 6.2.14.
Risk Assessment
An attacker can inject malicious script that executes in the user's browser, potentially leading to data theft or session hijacking.
Recommendation
Update the plugin to the latest version and apply input filtering mechanisms.
Other vulnerabilities in FluentForm
See all- CVE-2026-111831Medium
The FluentForm plugin up to version 6.2.15 contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. An unauthorized user may access functions requiring privileges.
- CVE-2026-103353Medium
A vulnerability in FluentForm (WordPress plugin) up to version 6.2.14 inclusive causes incorrect behavior order, allowing removal of important client functionality. The issue affects versions from n/a through 6.2.14.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP ManageNinja LLC FluentForm fluentform allows Stored XSS.This issue affects FluentForm: from n/a through 6.2.14.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS