What is the CVSS score of EUVD-2026-60918?

EUVD-2026-60918 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Fluent Forms Pro are affected by EUVD-2026-60918?

The Fluent Forms Pro Add On Pack contains an unauthenticated cross-site scripting vulnerability that threatens WordPress site security by enabling attackers to steal user credentials and hijack…. A patch is available.

How to fix or mitigate EUVD-2026-60918?

Within 24 hours, identify all WordPress installations using Fluent Forms Pro Add On Pack and document current versions; immediately disable the plugin if running version 6.2.11 or earlier and inform administrators of the security risk. Within 7 days, upgrade all instances to version 6.2.12 or later, test form functionality after updates to ensure no disruption, and document completion. Within 30 days, conduct user communication about the vulnerability window that exposed their data, implement a broader form security audit, and establish automated update monitoring for form-related plugins.

Fluent Forms Pro EUVD-2026-60918

| CVE-2026-66633 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-18 Patchstack

GHSA-x4rm-cxmr-jgw6

WordPress XSS Wordpress Plugin Fluent Forms Pro Add On Pack Wpmanageninja

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

AV:N/PR:N confirmed by unauthenticated web context; UI:R required for victim browser execution; S:C reflects browser scope escape; A:N because XSS does not demonstrably impact availability.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 18, 2026 - 15:16 vuln.today

Patch available

Aug 18, 2026 - 15:02 EUVD

CVE Published

Aug 18, 2026 - 13:59 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack < 6.2.12 versions.

AnalysisAI

Unauthenticated cross-site scripting in Fluent Forms Pro Add On Pack (versions below 6.2.12) allows a remote, unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by enticing them to interact with a crafted URL or form input. The vulnerability carries a CVSS 7.1 (High) rating with scope-changed impact, meaning the injected script can affect browser context beyond the plugin itself - enabling session hijacking, credential theft, or UI redirection against authenticated WordPress users. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available at version 6.2.12.

Technical ContextAI

Fluent Forms Pro Add On Pack (CPE: cpe:2.3:a:wpmanageninja:fluent_forms_pro_add_on_pack:*:*:*:*:*:*:*:*) is a premium WordPress plugin by WPManageNinja that extends the Fluent Forms form builder with advanced features. CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause: user-supplied input is reflected or stored in a rendered HTML context without adequate sanitization or escaping. In the WordPress plugin ecosystem, CWE-79 flaws typically arise when form field values, shortcode attributes, or query parameters are echoed into page output without running through WordPress core sanitization functions such as esc_html(), esc_attr(), or wp_kses(). The CVSS scope-changed metric (S:C) confirms the injected script executes in the victim's browser context - outside the server-side security boundary - which is the defining characteristic of client-side XSS exploitation.

RemediationAI

Update Fluent Forms Pro Add On Pack to version 6.2.12 or later, which contains the vendor-released patch per EUVD-2026-60918 and the Patchstack advisory. Updates can be applied via the WordPress admin dashboard under Plugins > Installed Plugins > Update, or via WP-CLI using 'wp plugin update fluentformpro'. If immediate patching is not possible, administrators should disable the specific form features or shortcodes associated with the vulnerable input handling until the update can be applied - though the precise vulnerable component is not enumerated in the available data, which limits the precision of this workaround. Implementing a web application firewall rule (e.g., via Cloudflare, Sucuri, or WordFence) to filter reflected script patterns in query parameters and form inputs can serve as a compensating control, but carries a risk of false positives on legitimate form submissions. The Patchstack advisory (https://patchstack.com/database/wordpress/plugin/fluentformpro/vulnerability/wordpress-fluent-forms-pro-add-on-pack-plugin-6-2-12-cross-site-scripting-xss-vulnerability) should be consulted for any additional vendor-specific mitigations.