What is the CVSS score of CVE-2026-16655?

CVE-2026-16655 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of Fluent Forms are affected by CVE-2026-16655?

Fluent Forms plugin for WordPress (versions through 6.2.7) allows unauthenticated attackers to inject persistent malicious scripts that execute when administrators review form submissions,…

How to fix or mitigate CVE-2026-16655?

Within 24 hours, audit all WordPress instances to identify those running Fluent Forms through version 6.2.7. Within 7 days, either disable the Fluent Forms plugin on affected sites or implement Web Application Firewall (WAF) rules to block submission attempts containing JavaScript patterns; additionally restrict form access to authenticated users where business requirements permit. Within 30 days, monitor Fluent Forms release channels for security patches; when available, upgrade all instances to the patched version and conduct a forensic audit of stored form submissions for any injected malicious content.

Fluent Forms CVE-2026-16655

EUVD-2026-50270 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-29 Wordfence

GHSA-qpq7-m29x-75p8

WordPress XSS Fluent Forms Customizable Contact Forms Survey Quiz Conversational Form Builder Wordpress Plugin Wpmanageninja

7.2

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

Unauthenticated network injection (PR:N) with scope change to the victim browser (S:C); rated UI:R because stored payload only executes when a victim views the injected page.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 29, 2026 - 10:52 vuln.today

CVE Published

Jul 29, 2026 - 09:31 cve.org

HIGH 7.2

DescriptionCVE.org

The Fluent Forms - Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Name Field Nested password Member in all versions up to, and including, 6.2.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored cross-site scripting in the Fluent Forms plugin for WordPress (all versions through 6.2.7) lets unauthenticated attackers persist malicious JavaScript via a nested 'password' member submitted through the form's Name field, because the input is neither sanitized on save nor escaped on output. The script executes in the browser of anyone - including administrators - who later views a page rendering the injected submission. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the unauthenticated, network-reachable nature makes it broadly abusable against exposed forms.

Technical ContextAI

Fluent Forms (vendor slug wpmanageninja/fluent_forms) is one of the most widely deployed WordPress form-builder plugins, handling public form submissions via AJAX endpoints. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation). The referenced source paths (boot/globals.php, app/Hooks/Ajax.php, app/Modules/SubmissionHandler/SubmissionHandler.php, app/Services/Form/SubmissionHandlerService.php, app/Modules/Form/FormDataParser.php, and GlobalNotificationService.php) trace the submission-handling pipeline: a Name field can carry a structured (nested) value, and the 'password' sub-member of that composite field is stored and later rendered without escaping. Because Name fields are commonly complex/composite objects, the nested member bypasses the sanitization applied to simpler scalar fields.

RemediationAI

Vendor-released patch: 6.2.8 - update the Fluent Forms plugin to version 6.2.8 or later, which corrects the input sanitization/output escaping for the nested Name-field member (see the changeset diff at https://plugins.trac.wordpress.org/changeset?old_path=%2Ffluentform/tags/6.2.7&new_path=%2Ffluentform/tags/6.2.8 and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/635e19ba-da98-459c-ab91-ff969b0812fd?source=cve). If immediate patching is not possible, deploy a WAF rule (e.g. Wordfence) to filter script payloads in form submissions, and restrict who can view raw submission entries in wp-admin so a stored payload has fewer opportunities to fire against privileged users; note WAF filtering may cause false positives on legitimate submissions containing angle brackets or code. Where a public Name field is not needed, temporarily disabling or restricting affected forms removes the injection surface at the cost of losing form functionality. After patching, audit existing stored submissions for injected markup, since the patch prevents new injections but does not necessarily neutralize payloads already saved.