Fluent Forms
Monthly
Stored Cross-Site Scripting in the Fluent Forms WordPress plugin (all versions before 6.2.6) allows a Contributor-level user with delegated form-management permissions to embed a persistent malicious script into a form field configuration setting, which executes against every subsequent visitor - including administrators - who loads any page rendering that form. The vulnerability is especially significant in multisite WordPress environments, where contributors routinely lack the unfiltered_html capability yet may hold form-management delegation rights. A publicly available proof-of-concept exists per WPScan; no active exploitation is confirmed in CISA KEV at time of analysis.
Subscription cancellation authorization bypass in the Fluent Forms WordPress plugin (all versions before 6.2.1) permits any authenticated low-privilege user to cancel subscriptions belonging to other site members by submitting a crafted request referencing a victim's subscription identifier. The plugin fails to verify that the requesting user owns the referenced subscription before processing the cancellation, a classic Insecure Direct Object Reference (IDOR) pattern. A public proof-of-concept is available via WPScan; no confirmed active exploitation campaign (CISA KEV) has been identified at time of analysis, and the CVSS base score of 3.1 reflects the limited, integrity-only impact.
Stored Cross-Site Scripting in the Fluent Forms WordPress plugin (all versions before 6.2.6) allows a Contributor-level user with delegated form-management permissions to embed a persistent malicious script into a form field configuration setting, which executes against every subsequent visitor - including administrators - who loads any page rendering that form. The vulnerability is especially significant in multisite WordPress environments, where contributors routinely lack the unfiltered_html capability yet may hold form-management delegation rights. A publicly available proof-of-concept exists per WPScan; no active exploitation is confirmed in CISA KEV at time of analysis.
Subscription cancellation authorization bypass in the Fluent Forms WordPress plugin (all versions before 6.2.1) permits any authenticated low-privilege user to cancel subscriptions belonging to other site members by submitting a crafted request referencing a victim's subscription identifier. The plugin fails to verify that the requesting user owns the referenced subscription before processing the cancellation, a classic Insecure Direct Object Reference (IDOR) pattern. A public proof-of-concept is available via WPScan; no confirmed active exploitation campaign (CISA KEV) has been identified at time of analysis, and the CVSS base score of 3.1 reflects the limited, integrity-only impact.