Fluent Forms Pro Add On Pack
Monthly
Unauthenticated cross-site scripting in Fluent Forms Pro Add On Pack (versions below 6.2.12) allows a remote, unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by enticing them to interact with a crafted URL or form input. The vulnerability carries a CVSS 7.1 (High) rating with scope-changed impact, meaning the injected script can affect browser context beyond the plugin itself - enabling session hijacking, credential theft, or UI redirection against authenticated WordPress users. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available at version 6.2.12.
An authenticated PHP Object Injection vulnerability in the Fluent Forms Pro Add On Pack plugin for WordPress (versions ≤6.2.6) allows a user with Subscriber-level privileges to inject a malicious serialized PHP object via deserialization of untrusted input. If a suitable POP chain is present and the user update integration is enabled with a mapped user meta field, the attacker can change user passwords and ultimately take over administrator accounts. Public exploit code is available, but the EPSS score (0.38%) suggests low real-world exploitation probability and the vulnerability is not listed in CISA's KEV.
Unauthenticated cross-site scripting in Fluent Forms Pro Add On Pack (versions below 6.2.12) allows a remote, unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by enticing them to interact with a crafted URL or form input. The vulnerability carries a CVSS 7.1 (High) rating with scope-changed impact, meaning the injected script can affect browser context beyond the plugin itself - enabling session hijacking, credential theft, or UI redirection against authenticated WordPress users. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available at version 6.2.12.
An authenticated PHP Object Injection vulnerability in the Fluent Forms Pro Add On Pack plugin for WordPress (versions ≤6.2.6) allows a user with Subscriber-level privileges to inject a malicious serialized PHP object via deserialization of untrusted input. If a suitable POP chain is present and the user update integration is enabled with a mapped user meta field, the attacker can change user passwords and ultimately take over administrator accounts. Public exploit code is available, but the EPSS score (0.38%) suggests low real-world exploitation probability and the vulnerability is not listed in CISA's KEV.