EUVD-2026-51005
GHSA-x2rq-2q3v-fw75
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
PR:L reflects the mandatory Contributor role prerequisite; the NVD-provided PR:N is inconsistent with the described access requirement and has been corrected.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Fluent Forms WordPress plugin before 6.2.6 does not sanitise and escape one of its form field configuration settings before outputting it inside an inline script when a form is rendered, which could allow users with a role as low as Contributor (with delegated form-management permission, and therefore lacking the unfiltered_html capability, e.g. in a multisite setup) to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor who loads the form, including administrators previewing it.
AnalysisAI
Stored Cross-Site Scripting in the Fluent Forms WordPress plugin (all versions before 6.2.6) allows a Contributor-level user with delegated form-management permissions to embed a persistent malicious script into a form field configuration setting, which executes against every subsequent visitor - including administrators - who loads any page rendering that form. The vulnerability is especially significant in multisite WordPress environments, where contributors routinely lack the unfiltered_html capability yet may hold form-management delegation rights. A publicly available proof-of-concept exists per WPScan; no active exploitation is confirmed in CISA KEV at time of analysis.
Technical ContextAI
Fluent Forms is a widely-deployed WordPress form-builder plugin (CPE: cpe:2.3:a:unknown:fluent_forms:*:*:*:*:*:*:*:*). The root cause (CWE-79: Improper Neutralization of Input During Web Page Generation) is a failure to sanitize or escape a form field configuration parameter before writing it into an inline JavaScript block at form render time. WordPress natively guards against HTML injection by lower-privileged users via the unfiltered_html capability check, but this flaw bypasses that gate entirely by placing attacker-controlled data into a JavaScript string context rather than HTML output - a code path that WordPress's built-in escaping pipeline does not cover. The inline script block injection means the browser interprets the attacker payload as trusted first-party JavaScript, not as markup, which defeats typical HTML-based XSS filters.
RemediationAI
The primary fix is to update the Fluent Forms plugin to version 6.2.6 or later, which resolves the sanitization and escaping defect. The patch is vendor-released and confirmed by EUVD-2026-51005; update via the WordPress admin dashboard or WP-CLI. Before or during patching, administrators should audit all users holding Contributor roles or higher who have been granted form-management delegation in Fluent Forms settings and revoke that delegation from any untrusted accounts - this removes the attack vector entirely at the cost of restricting contributor form-editing workflows. Administrators should also inspect all existing forms for unauthorized inline script content injected into field configuration settings as part of incident triage. In multisite environments, network admins should review whether form-management delegation policies are appropriately scoped. Advisory details at https://wpscan.com/vulnerability/3ccc3b34-44ed-4489-86e5-4c0ae800ef73/.
More in Fluent Forms
View allSame weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today