EUVD-2026-51790
GHSA-pqrj-crjh-4764
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-delivered reflected XSS with no auth required (PR:N), mandatory victim click (UI:R), and browser-context scope change (S:C); no availability impact.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Fluent Forms - Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'param' in all versions up to, and including, 6.2.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
AnalysisAI
Reflected Cross-Site Scripting in the Fluent Forms WordPress plugin (versions up to and including 6.2.8) allows unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser by embedding malicious payloads in the 'param' parameter. The vulnerability originates from insufficient sanitization and output escaping in Component.php (lines 1452 and 1456), and exploitation requires social engineering - the attacker must trick a user into clicking a crafted URL. A patch was released in version 6.2.9, confirmed by the WordPress Trac changeset. No public exploit code or CISA KEV listing is identified at time of analysis.
Technical ContextAI
Fluent Forms is a WordPress form builder plugin implementing drag-and-drop contact forms, surveys, and quizzes. The vulnerability resides in app/Modules/Component/Component.php, where the 'param' query parameter is reflected back into the HTTP response without adequate sanitization or contextual output escaping - a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) defect. The CVSS Scope:Changed (S:C) metric correctly captures how reflected XSS crosses security boundaries: the vulnerable component is the server-side WordPress plugin, but the actual impact materializes in the victim's browser (a different security principal), enabling session theft, credential harvesting, or forced browser actions on behalf of the victim. No special library or protocol beyond standard HTTP/HTML rendering is involved.
RemediationAI
Update the Fluent Forms plugin to version 6.2.9 or later, which contains the fix for insufficient input sanitization and output escaping in Component.php - confirmed by the WordPress Trac changeset at https://plugins.trac.wordpress.org/changeset?old_path=%2Ffluentform/tags/6.2.8&new_path=%2Ffluentform/tags/6.2.9. The update is available through the standard WordPress plugin dashboard. If immediate patching is not possible, a compensating control is to implement a Web Application Firewall (WAF) rule blocking reflected payloads in the 'param' query parameter on Fluent Forms endpoints; however, WAF bypass is possible with encoding variations, so this is a stopgap only. Additionally, educate privileged WordPress users (admins, editors) to treat unsolicited links referencing the WordPress admin or plugin pages with heightened scrutiny. Full details and threat intelligence are available at https://www.wordfence.com/threat-intel/vulnerabilities/id/547008fe-2585-4089-a710-71a83ae3d829.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today