EUVD-2026-60918
GHSA-x4rm-cxmr-jgw6
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
AV:N/PR:N confirmed by unauthenticated web context; UI:R required for victim browser execution; S:C reflects browser scope escape; A:N because XSS does not demonstrably impact availability.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
3DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack < 6.2.12 versions.
AnalysisAI
Unauthenticated cross-site scripting in Fluent Forms Pro Add On Pack (versions below 6.2.12) allows a remote, unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by enticing them to interact with a crafted URL or form input. The vulnerability carries a CVSS 7.1 (High) rating with scope-changed impact, meaning the injected script can affect browser context beyond the plugin itself - enabling session hijacking, credential theft, or UI redirection against authenticated WordPress users. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires no authentication (PR:N per CVSS vector) - any unauthenticated remote attacker can craft the malicious payload. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.1 High score is driven primarily by the scope-changed (S:C) metric combined with no authentication requirement (PR:N) and low attack complexity (AC:L), which inflates the rating relative to a same-scope XSS. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker identifies a WordPress site running Fluent Forms Pro below 6.2.12 and crafts a URL or form submission containing a malicious JavaScript payload in an unsanitized input parameter. The attacker delivers the crafted link - via phishing email, forum post, or comment - to an authenticated WordPress administrator; when the administrator clicks the link and their browser renders the vulnerable output, the injected script executes, exfiltrating session cookies or issuing authenticated admin actions on the attacker's behalf. … |
| Remediation | Update Fluent Forms Pro Add On Pack to version 6.2.12 or later, which contains the vendor-released patch per EUVD-2026-60918 and the Patchstack advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all WordPress installations using Fluent Forms Pro Add On Pack and document current versions; immediately disable the plugin if running version 6.2.11 or earlier and inform administrators of the security risk. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Fluent Forms Pro Add On Pack
View allSame weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today