Fluent Forms EUVD-2026-96056

Exploitation is NOT possible against a default installation. It requires a specific, documented-feature configuration created by a site administrator: a Custom HTML field on a published Fluent Forms form must contain a {get.*} SmartCode placeholder (e.g. {get.proof}) placed inside a URL-accepting attribute such as an iframe src or anchor href. Without that configuration there is no reflection sink. Limiting factors that reduce real-world risk: (1) the above non-default admin configuration must already exist; (2) UI:R - a victim must be tricked into clicking the attacker's crafted link carrying the matching query parameter; and (3) AC:H reflects the combination of these prerequisites. The attacker themselves needs no authentication (PR:N) and no account on the target site.

This is a genuine-but-moderate-priority issue, not a drop-everything emergency. The CVSS 3.1 base score of 4.7 (Medium) is driven down by AC:H and UI:R: successful exploitation chains together several conditions - AV:N (remote/network reachable) and PR:N (unauthenticated attacker), but requiring both victim interaction (UI:R, clicking a crafted link) AND a pre-existing non-default server-side configuration. The S:C scope change and C:L/I:L reflect typical reflected-XSS impact (script execution in the victim's browser context, limited confidentiality/integrity, no availability impact). No EPSS score was provided in the input, so exploitation probability cannot be quantified. The vulnerability is NOT listed in CISA KEV and there is no confirmed public exploit code in the provided data, so exploitation status is: no public exploit identified at time of analysis (the 'proof' parameter cited in the description is the researcher's own PoC placeholder name, not evidence of a published weaponized exploit). Reported by Wordfence, a credible WordPress-focused source. The combination of AC:H plus a required administrator misconfiguration means real-world exploitability is narrow and opportunistic rather than mass-automatable - treat as a routine patch-cycle item unless a site is known to use the {get.*} SmartCode pattern in Custom HTML URL attributes, in which case prioritize higher.

An attacker crafts a URL pointing to a page hosting a vulnerable Fluent Forms form, appending a query parameter (e.g. ?proof=<script-payload>) that matches a {get.NAME} SmartCode the site admin placed inside a Custom HTML field's URL-accepting attribute (such as an iframe src or anchor href). The attacker distributes this link via phishing or a malicious post; when a logged-in user or admin clicks it, the unsanitized value is reflected into the page and the script executes in their browser, enabling session theft or actions in the victim's context. No public exploit code is confirmed in the provided data, though the reporter references a PoC parameter name.