CVE-2026-66633 HIGH

CVE-2026-66633: WordPress Fluent Forms Pro Add On Pack plugin < 6.2.12 - Cross Site Scripting (XSS) vulnerability

Vendor Wpmanageninja
Product Fluent Forms Pro Add On Pack
Weakness CWE-79 · XSS
Published August 18, 2026
Last update August 18, 2026
View on NVD All CVEs

CVSS base score

7.1/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack < 6.2.12 versions.

Explanation of Vulnerability in Simple Terms

02Summary

Fluent Forms Pro Add On Pack versions before 6.2.12 contain a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts. An attacker can craft a malicious link or page that, when visited by a site user, executes arbitrary JavaScript in their browser. This can lead to session hijacking, credential theft, or unauthorized actions performed on behalf of the victim.

What an attacker can do

03Attacker Capabilities

Inject and execute malicious JavaScript in a user's browser to steal session data, credentials, or perform unauthorized actions.

Potential impact on your site

04Site Impact

Site users' accounts and data are at risk if they interact with attacker-crafted content; admin accounts are particularly valuable targets.

Conditions required to exploit

05Prerequisites

A site user must visit an attacker-controlled page or click a malicious link while logged into the site.

Key dates

06Disclosure timeline

August 18, 2026 CVE published
August 18, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-66460 WordPress AfterShip Tracking plugin <= 1.18.1 - Cross Site Scripting (XSS) vulnerability CVE-2026-66467 WordPress FluentCommunity plugin <= 2.7.5 - Cross Site Scripting (XSS) vulnerability CVE-2026-28569 WordPress SSL Zen plugin <= 4.7.43 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2026-61974 WordPress Mang Board WP plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerability CVE-2026-61965 WordPress GeekyBot plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability