Fluentform
Monthly
Stored cross-site scripting (XSS) in the FluentForm WordPress plugin (versions through 6.2.14) allows authenticated attackers with low privileges to inject malicious scripts into form fields, which execute when other users view the affected page. Exploitation requires victim interaction and a low-privileged WordPress account, limiting the attack to authenticated scenarios. No public exploit code has been identified, and the risk is considered moderate due to these prerequisites.
FluentForm WordPress plugin versions through 6.2.14 allow a remote, unauthenticated attacker to remove or alter intended client-side form functionality due to an incorrect behavior order flaw (CWE-696). The assessed impact is limited to integrity of client-side behavior (I:L) with no data disclosure, server compromise, or availability loss, and no public exploit or active exploitation has been identified at time of analysis.
Stored cross-site scripting (XSS) in the FluentForm WordPress plugin (versions through 6.2.14) allows authenticated attackers with low privileges to inject malicious scripts into form fields, which execute when other users view the affected page. Exploitation requires victim interaction and a low-privileged WordPress account, limiting the attack to authenticated scenarios. No public exploit code has been identified, and the risk is considered moderate due to these prerequisites.
FluentForm WordPress plugin versions through 6.2.14 allow a remote, unauthenticated attacker to remove or alter intended client-side form functionality due to an incorrect behavior order flaw (CWE-696). The assessed impact is limited to integrity of client-side behavior (I:L) with no data disclosure, server compromise, or availability loss, and no public exploit or active exploitation has been identified at time of analysis.