What is the CVSS score of CVE-2026-2365?

CVE-2026-2365 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of WordPress are affected by CVE-2026-2365?

Organizations using Fluent Forms Pro (versions up to 6.1.17) face a stored cross-site scripting vulnerability that could allow attackers to inject malicious code into form submissions, potentially…

How to fix or mitigate CVE-2026-2365?

Within 24 hours: Audit all Fluent Forms Pro installations and document version numbers; immediately disable the affected `fluentform_step_form_save_data` AJAX action if feasible. Within 7 days: Implement WAF rules to sanitize and block malicious payloads in form submissions; review stored form data logs for indicators of compromise. Within 30 days: Monitor vendor releases closely for patch availability; consider migrating to alternative form plugins if the vendor does not release a patch within 60 days, or apply input validation workarounds at the application level.

WordPress CVE-2026-2365

HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-03-05 security@wordfence.com

WordPress XSS

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 04:15 nvd

HIGH 7.2

DescriptionCVE.org

The Fluent Forms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the fluentform_step_form_save_data AJAX action in all versions up to, and including, 6.1.17. This is due to the draft form submission endpoint being publicly accessible without authentication or nonce verification, combined with insufficient input sanitization and output escaping of form field data. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrator views a partial form entry.

AnalysisAI

Stored XSS in Fluent Forms Pro for WordPress through version 6.1.17 allows unauthenticated attackers to inject malicious scripts into draft form submissions due to missing authentication and insufficient input sanitization on the fluentform_step_form_save_data AJAX action. The injected scripts execute when site administrators access partial form entries, potentially compromising administrator accounts and site integrity. No patch is currently available.

Technical ContextAI

Classified as CWE-79 (Cross-site Scripting (XSS)). Affects Fluent Forms Pro (WordPress plugin). The Fluent Forms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the fluentform_step_form_save_data AJAX action in all versions up to, and including, 6.1.17. This is due to the draft form submission endpoint being publicly accessible without authentication or nonce verification, combined with insufficient input sanitization and output escaping of form field data. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will ex

Affected ProductsAI

Vendor: WordPress. Product: Fluent Forms Pro (WordPress plugin).

RemediationAI

Monitor vendor advisories for a patch. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.