What is the CVSS score of CVE-2026-18146?

CVE-2026-18146 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.4%.

Which versions of Fluent Forms are affected by CVE-2026-18146?

Organizations using the Fluent Forms WordPress plugin face potential administrator account compromise and unauthorized administrative access through a form submission vulnerability that allows code…

How to fix or mitigate CVE-2026-18146?

Immediately identify all WordPress deployments running Fluent Forms and document their current versions to establish your exposure baseline. Within 7 days, upgrade Fluent Forms to version 6.2.12 on all affected instances, verify successful deployment, and audit recent admin access logs to confirm no compromise occurred during the exposure window. By day 30, complete a full security review of administrator accounts for unauthorized activity or privilege changes, implement input validation and Web Application Firewall rules for form submissions, and establish a patch management process for WordPress plugins to prevent similar update delays.

Fluent Forms CVE-2026-18146

EUVD-2026-57736 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-13 Wordfence

GHSA-3wxr-qqfv-gjrh

WordPress XSS Fluent Forms Customizable Contact Forms Survey Quiz Conversational Form Builder Wordpress Plugin Wpmanageninja

7.2

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

UI:R applied because administrator must actively view Submission Logs for stored payload to execute; all other vendor metrics retained.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 07:21 vuln.today

CVE Published

Aug 13, 2026 - 06:38 nvd

HIGH 7.2

DescriptionCVE.org

The Fluent Forms - Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Notification Smartcode Values in all versions up to, and including, 6.2.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in the browser of an administrator (or any user with the Fluent Forms entry-viewing capability) when they view the form's entry Submission Logs in the WordPress admin dashboard. Exploitation requires that a site administrator or Fluent Forms manager has configured an email notification whose subject or static (direct) Send To value references an attacker-influenced Smartcode such as an input_password field value, a cookie value, or submission.response.

AnalysisAI

Stored Cross-Site Scripting in the Fluent Forms WordPress plugin (all versions through 6.2.11) allows unauthenticated attackers to inject arbitrary JavaScript via form submission fields that are referenced by administrator-configured Notification Smartcodes, with payload execution occurring in the WordPress admin dashboard when Submission Logs are viewed. The root cause is insufficient sanitization and output escaping in ShortCodeParser.php and the EmailNotification component, confirmed by Wordfence and traceable to specific source-level references. A patch was released in version 6.2.12; no public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

Fluent Forms implements a Smartcode system - similar to template variables - that allows administrators to embed dynamic form submission data into email notification subjects and recipient fields using tokens such as {input.input_password}, {submission.response}, or cookie-derived values. These tokens are processed by ShortCodeParser.php (lines 142, 145) and EmailNotification.php (line 196), and the resolved values are stored and later rendered in the Submission Logs view within the WordPress admin dashboard (form_entries.js). CWE-79 (Improper Neutralization of Input During Web Page Generation - 'Cross-site Scripting') applies because user-supplied form input that flows through the Smartcode resolution pipeline is not properly escaped before being output into the HTML context of the admin dashboard. The affected CPE is cpe:2.3:a:wpmanageninja:fluent_forms_-_customizable_contact_forms,_survey,_quiz,_&_conversational_form_builder:*:*:*:*:*:*:*:*. The changeset between 6.2.11 and 6.2.12 specifically targets ShortCodeParser.php, confirming the fix location.

RemediationAI

Upgrade Fluent Forms to version 6.2.12 or later immediately; this release directly addresses the insufficient output escaping in ShortCodeParser.php, confirmed by the plugin changeset at plugins.trac.wordpress.org/changeset/3640683/fluentform/trunk/app/Services/FormBuilder/ShortCodeParser.php. If upgrade is not immediately feasible, audit all Fluent Forms email notification configurations and remove any Smartcode references to attacker-influenced fields - specifically input_password values, cookie-derived tokens, or submission.response - from notification subject lines and static Send To fields; this eliminates the configuration condition required for exploitation but requires manual review of every notification template. As a more aggressive workaround, disabling email notifications entirely removes the attack vector but also removes all notification functionality, which may be unacceptable in production. Note that simply restricting public form access does not remediate the vulnerability if forms with vulnerable notification configs remain accessible. Full advisory and patch details at https://www.wordfence.com/threat-intel/vulnerabilities/id/643f92e2-b14e-4056-97fc-1c631027c54f.