EUVD-2026-50270
GHSA-qpq7-m29x-75p8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLocate public Fluent Form with Name field
-
DeliverySubmit form with script in nested 'password' member
-
ExploitPayload stored unsanitized
-
ExecutionAdmin views submission entry
-
PersistScript executes in admin session
-
ImpactSteal session or perform admin actions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a publicly reachable Fluent Forms form (version ≤ 6.2.7) that includes a Name field, and requires the attacker to populate the nested 'password' sub-member of that Name field with a script payload during a normal, unauthenticated submission. The injection step needs no authentication or user interaction (PR:N/UI:N), but actual script execution is gated on a subsequent victim - typically an administrator or reviewer - viewing the page or admin entry that renders the stored submission. Limiting factors: the site must expose a form using the affected Name-field construction, the payload only fires when the stored value is later displayed, and updating to 6.2.8 removes the condition entirely. |
| Impact | The signals are moderately concerning but not top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2) reflects unauthenticated network exploitation with low complexity and a scope change (script executes in a victim's browser context, distinct from the vulnerable component), but only Low confidentiality and Low integrity impact and no availability impact - typical of stored XSS. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so exploitation likelihood cannot be quantified from the input; the absence of KEV/POC suggests this is not yet actively weaponized. The realistic priority driver is the plugin's very large install base combined with unauthenticated injection: any site with an exposed Fluent Form is reachable, though impact per hit is bounded by XSS (session/credential theft, admin-panel actions) rather than direct server compromise. Note UI:N in the CVSS vector applies to the injection step; actual script execution still requires a victim to view the injected page, which slightly tempers real-world urgency. |
| Exploit ScenarioDerived | An unauthenticated attacker submits a public Fluent Form, crafting the Name field so its nested 'password' member contains a JavaScript payload such as an image tag with an onerror handler. The payload is stored unescaped; when a site administrator later opens the submissions/entries view or any page rendering that value, the script runs in the admin's authenticated session, enabling cookie theft or unauthorized admin actions. No exploit code is publicly identified at time of analysis, but the low attack complexity makes weaponization straightforward. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 29, 2026
Stored cross-site scripting in the Fluent Forms plugin for WordPress (all versions through 6.2.7) lets unauthenticated attackers persist malicious JavaScript via a nested 'password' member submitted through the form's Name field, because the input is neither sanitized on save nor escaped on output. The script executes in the browser of anyone - including administrators - who later views a page rendering the injected submission. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the unauthenticated, network-reachable nature makes it broadly abusable against exposed forms.
RemediationAI
Vendor-released patch: 6.2.8 - update the Fluent Forms plugin to version 6.2.8 or later, which corrects the input sanitization/output escaping for the nested Name-field member (see the changeset diff at https://plugins.trac.wordpress.org/changeset?old_path=%2Ffluentform/tags/6.2.7&new_path=%2Ffluentform/tags/6.2.8 and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/635e19ba-da98-459c-ab91-ff969b0812fd?source=cve). If immediate patching is not possible, deploy a WAF rule (e.g. Wordfence) to filter script payloads in form submissions, and restrict who can view raw submission entries in wp-admin so a stored payload has fewer opportunities to fire against privileged users; note WAF filtering may cause false positives on legitimate submissions containing angle brackets or code. Where a public Name field is not needed, temporarily disabling or restricting affected forms removes the injection surface at the cost of losing form functionality. After patching, audit existing stored submissions for injected markup, since the patch prevents new injections but does not necessarily neutralize payloads already saved.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Fluent Forms (vendor slug wpmanageninja/fluent_forms) is one of the most widely deployed WordPress form-builder plugins, handling public form submissions via AJAX endpoints. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation). The referenced source paths (boot/globals.php, app/Hooks/Ajax.php, app/Modules/SubmissionHandler/SubmissionHandler.php, app/Services/Form/SubmissionHandlerService.php, app/Modules/Form/FormDataParser.php, and GlobalNotificationService.php) trace the submission-handling pipeline: a Name field can carry a structured (nested) value, and the 'password' sub-member of that composite field is stored and later rendered without escaping. Because Name fields are commonly complex/composite objects, the nested member bypasses the sanitization applied to simpler scalar fields.
Know when Fluent Forms Customizable Contact Forms Survey Quiz Conversational Form Builder gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Unauthenticated network injection (PR:N) with scope change to the victim browser (S:C); rated UI:R because stored payload only executes when a victim views the injected page.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Fluent Forms - Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Name Field Nested password Member in all versions up to, and including, 6.2.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Executive ViewAI
Fluent Forms plugin for WordPress (versions through 6.2.7) allows unauthenticated attackers to inject persistent malicious scripts that execute when administrators review form submissions, potentially enabling account compromise and data theft across affected WordPress installations. Organizations using this plugin face immediate risk with no security patch currently available.
No vendor-released patch identified at time of analysis. Interim mitigations: disable Fluent Forms plugin pending patch release, implement WAF rules filtering JavaScript patterns in form field submissions, restrict form access to authenticated users only, conduct immediate audit of existing submissions for malicious injected scripts, and evaluate alternative form solution vendors with proactive security assessment processes.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Insecure Direct Object Reference in the WordPress Fluent Forms plugin (versions through 6.2.0) allows authenticated user
Stored Cross-Site Scripting in the Fluent Forms WordPress plugin (all versions through 6.2.11) allows unauthenticated at
Stored Cross-Site Scripting (XSS) in Fluent Forms WordPress plugin versions up to 6.2.1 allows authenticated contributor
Incorrect authorization in the Fluent Forms WordPress plugin (versions up to and including 6.2.1) enables any authentica
Fluent Forms for WordPress (all versions up to and including 6.2.5) fails to verify that a user is authorized before per
Insecure Direct Object Reference in Fluent Forms for WordPress (versions up to and including 6.2.8) exposes other users'
Payment status manipulation in the Fluent Forms WordPress plugin (versions up to and including 6.1.21) allows unauthenti
Fluent Forms plugin for WordPress up to version 6.2.1 allows authenticated administrators to read arbitrary files readab
Reflected cross-site scripting in the Fluent Forms WordPress plugin (all versions up to and including 6.2.14) allows una
Exploit-DB