Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder

Information

Software Type Plugin
Software Slug fluentform (view on wordpress.org)
Software Status Active
Software Author wpmanageninja
Software Website wpmanageninja.com
Software Downloads 19,885,653
Software Active Installs 800,000
Software Record Last Updated October 16, 2026

Showing 1-20 of 45 Vulnerabilities

Submit a Vulnerability
Fluent Forms <= 6.2.5 - Missing Authorization to Authenticated (Custom+) Sensitive Data Exposure and Modification
5.4
CVE-2026-15178
Oct 9, 2026
Researcher: Nadir Şensoy
Fluent Forms <= 6.2.14 - Reflected Cross-Site Scripting via '{get.*}' Editor SmartCode Parameter
4.7
CVE-2026-101324
Oct 9, 2026
Researcher: Santh
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.2.14 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2026-103343
Oct 1, 2026
Researcher: Intrudify
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.2.14 - Missing Authorization
5.3
CVE-2026-103353
Oct 1, 2026
Researcher: MYUNGYONG LEE
Fluent Forms <= 6.2.11 - Unauthenticated Stored Cross-Site Scripting via Notification Smartcode Values
7.2
CVE-2026-18146
Aug 12, 2026
Researcher: Adrien Brunner
Fluent Forms <= 6.2.4 - Insecure Direct Object Reference to Authenticated (Form Manager+) Cross-Form Submission Entry Deletion
4.3
CVE-2026-11578
Aug 11, 2026
Researcher: Muni Nitish Kumar Yaddala
Fluent Forms <= 6.2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Subscription Cancellation
4.3
CVE-2026-11880
Aug 10, 2026
Researcher: Pedro Pinho
Fluent Forms <= 6.2.8 - Reflected Cross-Site Scripting via 'param'
6.1
CVE-2026-17571
Jul 31, 2026
Researcher: Osvaldo Noe Gonzalez Del Rio (Os)
Fluent Forms <= 6.2.8 - Unauthenticated Sensitive Information Exposure via Insecure Direct Object Reference and Weak Transaction Hash in 'transaction' Parameter
5.3
CVE-2026-17567
Jul 30, 2026
Researcher: ChinhNguyen
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder < 6.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2026-11881
Jul 30, 2026
Researcher: Muni Nitish Kumar Yaddala
Fluent Forms <= 6.2.7 - Unauthenticated Stored Cross-Site Scripting via Name Field Nested `password` Member
7.2
CVE-2026-16655
Jul 28, 2026
Researcher: daroo
Fluent Forms <= 6.2.1 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Subscription Cancellation via 'subscription_id'
5.4
CVE-2026-5069
Jul 9, 2026
Researcher: Fernando Mecozzi
Fluent Forms <= 6.2.0 - Authenticated (Subscriber+) Authorization Bypass via 'table' Parameter
8.2
CVE-2026-5395
May 13, 2026
Researcher: Sander Horsman
Fluent Forms <= 6.1.21 - Authenticated (Subscriber+) Authorization Bypass via 'form_id' Parameter
8.2
CVE-2026-5396
May 13, 2026
Researcher: Sander Horsman
Fluent Forms <= 6.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'permission_message' Shortcode Attribute
6.4
CVE-2026-6828
May 12, 2026
Researcher: zaim
Fluent Forms <= 6.2.1 - Authenticated (Administrator+) Arbitrary File Read via Path Traversal in Email Attachment
4.9
CVE-2026-6344
May 5, 2026
Researcher: Niv Kochan
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.1.21 - Insecure Direct Object Reference in Stripe SCA Confirmation to Unauthenticated Payment Status Modification
5.3
CVE-2026-4160
Apr 16, 2026
Researcher: Prickly Cactus
Fluent Forms <= 6.1.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via AI Form Builder Module
6.4
CVE-2026-0996
Feb 9, 2026
Researcher: Osvaldo Noe Gonzalez Del Rio (Os)
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.1.14 - Missing Authorization
4.3
CVE-2026-25313
Jan 25, 2026
Researcher: benzdeus
FluentForm <= 6.1.11 - Unauthenticated Arbitrary Shortcode Execution
6.5
CVE-2025-69001
Jan 13, 2026
Researcher: hashiramasenju333
Title Status CVE ID CVSS Researchers Date
Fluent Forms <= 6.2.5 - Missing Authorization to Authenticated (Custom+) Sensitive Data Exposure and Modification Patched CVE-2026-15178 5.4 Nadir Şensoy October 9, 2026
Fluent Forms <= 6.2.14 - Reflected Cross-Site Scripting via '{get.*}' Editor SmartCode Parameter Patched CVE-2026-101324 4.7 Santh October 9, 2026
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.2.14 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2026-103343 6.4 Intrudify October 1, 2026
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.2.14 - Missing Authorization Patched CVE-2026-103353 5.3 MYUNGYONG LEE October 1, 2026
Fluent Forms <= 6.2.11 - Unauthenticated Stored Cross-Site Scripting via Notification Smartcode Values Patched CVE-2026-18146 7.2 Adrien Brunner August 12, 2026
Fluent Forms <= 6.2.4 - Insecure Direct Object Reference to Authenticated (Form Manager+) Cross-Form Submission Entry Deletion Patched CVE-2026-11578 4.3 Muni Nitish Kumar Yaddala August 11, 2026
Fluent Forms <= 6.2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Subscription Cancellation Patched CVE-2026-11880 4.3 Pedro Pinho August 10, 2026
Fluent Forms <= 6.2.8 - Reflected Cross-Site Scripting via 'param' Patched CVE-2026-17571 6.1 Osvaldo Noe Gonzalez Del Rio (Os) July 31, 2026
Fluent Forms <= 6.2.8 - Unauthenticated Sensitive Information Exposure via Insecure Direct Object Reference and Weak Transaction Hash in 'transaction' Parameter Patched CVE-2026-17567 5.3 ChinhNguyen July 30, 2026
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder < 6.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2026-11881 6.4 Muni Nitish Kumar Yaddala July 30, 2026
Fluent Forms <= 6.2.7 - Unauthenticated Stored Cross-Site Scripting via Name Field Nested `password` Member Patched CVE-2026-16655 7.2 daroo July 28, 2026
Fluent Forms <= 6.2.1 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Subscription Cancellation via 'subscription_id' Patched CVE-2026-5069 5.4 Fernando Mecozzi July 9, 2026
Fluent Forms <= 6.2.0 - Authenticated (Subscriber+) Authorization Bypass via 'table' Parameter Patched CVE-2026-5395 8.2 Sander Horsman May 13, 2026
Fluent Forms <= 6.1.21 - Authenticated (Subscriber+) Authorization Bypass via 'form_id' Parameter Patched CVE-2026-5396 8.2 Sander Horsman May 13, 2026
Fluent Forms <= 6.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'permission_message' Shortcode Attribute Patched CVE-2026-6828 6.4 zaim May 12, 2026
Fluent Forms <= 6.2.1 - Authenticated (Administrator+) Arbitrary File Read via Path Traversal in Email Attachment Patched CVE-2026-6344 4.9 Niv Kochan May 5, 2026
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.1.21 - Insecure Direct Object Reference in Stripe SCA Confirmation to Unauthenticated Payment Status Modification Patched CVE-2026-4160 5.3 Prickly Cactus April 16, 2026
Fluent Forms <= 6.1.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via AI Form Builder Module Patched CVE-2026-0996 6.4 Osvaldo Noe Gonzalez Del Rio (Os) February 9, 2026
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.1.14 - Missing Authorization Patched CVE-2026-25313 4.3 benzdeus January 25, 2026
FluentForm <= 6.1.11 - Unauthenticated Arbitrary Shortcode Execution Patched CVE-2025-69001 6.5 hashiramasenju333 January 13, 2026

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation