What the vulnerability does
01Description
The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'param' in all versions up to, and including, 6.2.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Explanation of Vulnerability in Simple Terms
02Summary
Fluent Forms contains a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. The vulnerability requires user interaction—typically clicking a malicious link—and affects the site's scope beyond the vulnerable component. An attacker can steal session cookies, redirect users, or deface form content without needing authentication.
What an attacker can do
03Attacker Capabilities
Inject malicious JavaScript that runs in other users' browsers when they view affected pages.
Potential impact on your site
04Site Impact
Users' sessions and data can be compromised; attackers can deface forms or steal sensitive information submitted through them.
Conditions required to exploit
05Prerequisites
Victim must click a malicious link or visit an attacker-controlled page; no authentication required.
Key dates
06Disclosure timeline
August 1, 2026
CVE published
