CVE-2026-11881
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
The Fluent Forms WordPress plugin before 6.2.6 does not sanitize and escape one of its form field configuration settings before outputting it inside an inline script when a form is rendered. Users with a role as low as Contributor (with delegated form-management permission, but lacking unfiltered_html, e.g., in a multisite setup) can perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor who loads the form, including administrators previewing it.
Risk Assessment
An attacker can inject a persistent JavaScript script that executes in the browsers of visitors, potentially stealing administrator sessions or modifying site content.
Recommendation
Update the Fluent Forms plugin to version 6.2.6 or later.
Other vulnerabilities in Fluent Forms
See all- CVE-2026-18146High
The Fluent Forms plugin for WordPress (versions up to 6.2.11) is vulnerable to Stored Cross-Site Scripting via Notification Smartcode Values. Unauthenticated attackers can inject arbitrary web scripts that execute in the browser of an administrator when viewing submission logs. Exploitation requires configured email notifications with attacker-influenced Smartcode values.
- CVE-2026-17571Medium
The Fluent Forms plugin for WordPress up to version 6.2.8 contains a Reflected Cross-Site Scripting (XSS) vulnerability via the 'param' parameter. Unauthenticated attackers can inject arbitrary web scripts that execute if they trick a user into clicking a link.
- CVE-2026-17567Medium
The Fluent Forms plugin for WordPress up to version 6.2.8 is vulnerable to Insecure Direct Object Reference (IDOR) via the 'transaction' parameter. Missing validation on a user-controlled key allows unauthenticated attackers to brute-force valid transaction hashes and view sensitive payment receipt data including customer name, email, billing address, order items, payment method, and payment status of other users.
- CVE-2026-16655High
The Fluent Forms plugin for WordPress up to version 6.2.7 has a Stored XSS vulnerability via the Name field nested in `password`. An unauthenticated attacker can inject arbitrary JavaScript that executes when a user views the page.
- CVE-2026-5069Medium
The Fluent Forms plugin for WordPress up to version 6.2.1 contains an incorrect authorization vulnerability in the 'subscription_id' parameter. Insufficient ownership checks in the AJAX payment cancellation flow allow authenticated attackers with subscriber-level access or higher to cancel other users' subscriptions.
- CVE-2026-11578Low
The Fluent Forms WordPress plugin before version 6.2.5 does not properly restrict the deletion of form submission entries to the forms a restricted Manager is authorized to manage. This allows a Manager limited to specific forms to permanently delete submission entries belonging to other forms. This requires a non-default configuration where an administrator has created at least one Manager restricted to specific forms.
- CVE-2026-11880Low
The Fluent Forms WordPress plugin before version 6.2.1 does not properly verify ownership before processing a subscription cancellation request, allowing authenticated users with low privileges to cancel subscriptions belonging to other users.
Original NVD description (English source)
The Fluent Forms WordPress plugin before 6.2.6 does not sanitise and escape one of its form field configuration settings before outputting it inside an inline script when a form is rendered, which could allow users with a role as low as Contributor (with delegated form-management permission, and therefore lacking the unfiltered_html capability, e.g. in a multisite setup) to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor who loads the form, including administrators previewing it.