CVE-2026-16655

The Fluent Forms plugin for WordPress (versions up to 6.2.11) is vulnerable to Stored Cross-Site Scripting via Notification Smartcode Values. Unauthenticated attackers can inject arbitrary web scripts that execute in the browser of an administrator when viewing submission logs. Exploitation requires configured email notifications with attacker-influenced Smartcode values.

The Fluent Forms plugin for WordPress up to version 6.2.8 contains a Reflected Cross-Site Scripting (XSS) vulnerability via the 'param' parameter. Unauthenticated attackers can inject arbitrary web scripts that execute if they trick a user into clicking a link.

The Fluent Forms plugin for WordPress up to version 6.2.8 is vulnerable to Insecure Direct Object Reference (IDOR) via the 'transaction' parameter. Missing validation on a user-controlled key allows unauthenticated attackers to brute-force valid transaction hashes and view sensitive payment receipt data including customer name, email, billing address, order items, payment method, and payment status of other users.

The Fluent Forms WordPress plugin before 6.2.6 does not sanitize and escape one of its form field configuration settings before outputting it inside an inline script when a form is rendered. Users with a role as low as Contributor (with delegated form-management permission, but lacking unfiltered_html, e.g., in a multisite setup) can perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor who loads the form, including administrators previewing it.

The Fluent Forms plugin for WordPress up to version 6.2.1 contains an incorrect authorization vulnerability in the 'subscription_id' parameter. Insufficient ownership checks in the AJAX payment cancellation flow allow authenticated attackers with subscriber-level access or higher to cancel other users' subscriptions.

The Fluent Forms WordPress plugin before version 6.2.5 does not properly restrict the deletion of form submission entries to the forms a restricted Manager is authorized to manage. This allows a Manager limited to specific forms to permanently delete submission entries belonging to other forms. This requires a non-default configuration where an administrator has created at least one Manager restricted to specific forms.

The Fluent Forms WordPress plugin before version 6.2.1 does not properly verify ownership before processing a subscription cancellation request, allowing authenticated users with low privileges to cancel subscriptions belonging to other users.