What is the CVSS score of CVE-2026-6828?

CVE-2026-6828 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Fluent Forms CVE-2026-6828

EUVD-2026-29897 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-13 Wordfence

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 13, 2026 - 05:31 vuln.today

CVE Published

May 13, 2026 - 04:26 nvd

MEDIUM 6.4

DescriptionCVE.org

The Fluent Forms - Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'permission_message' parameter in all versions up to, and including, 6.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting (XSS) in Fluent Forms WordPress plugin versions up to 6.2.1 allows authenticated contributors and above to inject arbitrary JavaScript into pages via the 'permission_message' parameter, which executes when any user views the affected page. The vulnerability stems from insufficient input sanitization and output escaping in the Component module. No active exploitation or public proof-of-concept has been reported, but the low attack complexity and network accessibility make this a practical risk for WordPress sites with contributor-level user accounts.

Technical ContextAI

Fluent Forms is a WordPress plugin that enables creation of customizable contact forms, surveys, quizzes, and conversational form builders. The vulnerability exists in the Component module (specifically Component.php around lines 467 and 513 in versions through 6.1.20) where the 'permission_message' parameter is processed without proper sanitization before being output to the page. The root cause (CWE-79: Improper Neutralization of Input During Web Page Generation) indicates the plugin fails to escape user-supplied input before rendering it in the DOM, allowing malicious scripts to execute in the context of the WordPress site. This is a classic stored XSS vulnerability where the payload persists in the database and affects all subsequent visitors.

RemediationAI

Update Fluent Forms to version 6.2.2 or later immediately. The patch is available through the WordPress plugin repository and can be applied via the WordPress admin dashboard (Plugins → Updates) or manually by downloading the latest version from plugins.wordpress.org/fluentform/. The upstream repository indicates a fix in the Component.php module (changeset 3513845) addressing input sanitization and output escaping of the 'permission_message' parameter. As an interim compensating control if immediate patching is not possible, restrict contributor-level access to only trusted administrators using WordPress user role management; however, this does not eliminate the risk for existing users with that access. Additionally, audit all existing forms for suspicious 'permission_message' values that may contain script tags or JavaScript event handlers by reviewing the WordPress database table wp_postmeta or the plugin's internal form storage. Monitor user activity logs for unauthorized form modifications by contributors.