CVE-2026-94675
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The Fluent Forms Pro Add On Pack plugin versions up to 6.2.13 contain an unauthenticated Cross Site Scripting (XSS) vulnerability. This means an attacker without logging in can inject malicious scripts into the page.
Risk Assessment
XSS attacks can lead to session theft, account takeover, malware distribution, or website defacement.
Recommendation
It is recommended to update the Fluent Forms Pro Add On Pack plugin to the latest version that includes a fix for this vulnerability.
Other vulnerabilities in Fluent Forms Pro Add On Pack
See all- CVE-2026-94669Medium
Missing Authorization vulnerability in WP ManageNinja LLC Fluent Forms Pro Add On Pack fluentformpro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fluent Forms Pro Add On Pack: from n/a through 6.2.13.
- CVE-2026-81297High
Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack versions up to 6.2.12.
- CVE-2026-81296High
Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack versions up to 6.2.12.
- CVE-2026-66633High
Unauthenticated XSS vulnerability in Fluent Forms Pro Add On Pack versions prior to 6.2.12. An attacker can inject malicious scripts that execute in the victim's browser.
- CVE-2026-15962High
The Fluent Forms Pro Add On Pack plugin for WordPress up to version 6.2.6 is vulnerable to PHP Object Injection via deserialization of untrusted input. Authenticated attackers with Subscriber-level access or above can inject a PHP Object. The presence of a POP chain allows changing user passwords and potentially taking over administrator accounts. Exploitation is only possible if user update integration is enabled and a user meta field is mapped.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack <= 6.2.13 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS