Fluent Forms <= 6.2.8 - Reflected Cross-Site Scripting via 'param'

Wordfence Intelligence   >   Vulnerability Database   >   Fluent Forms <= 6.2.8 - Reflected Cross-Site Scripting via 'param'
6.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE CVE-2026-17571
CVSS 6.1 (Medium)
Publicly Published July 31, 2026
Last Updated August 1, 2026
Researcher Osvaldo Noe Gonzalez Del Rio (Os) - krei.dev | ogbuilders.io

Description

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'param' in all versions up to, and including, 6.2.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Learn more about Cross-Site Scripting vulnerabilities and how to prevent them.

References

Share

Vulnerability Details for Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder

Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder

Software Type Plugin
Software Slug fluentform (view on wordpress.org)
Patched? Yes
Remediation Update to version 6.2.9, or a newer patched version
Affected Version
  • <= 6.2.8
Patched Version
  • 6.2.9

Recent vulnerabilities in Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder

Fluent Forms <= 6.2.11 - Unauthenticated Stored Cross-Site Scripting via Notification Smartcode Values
7.2
CVE-2026-18146
Aug 12, 2026
Researcher: Adrien Brunner
Fluent Forms <= 6.2.4 - Insecure Direct Object Reference to Authenticated (Form Manager+) Cross-Form Submission Entry Deletion
4.3
CVE-2026-11578
Aug 11, 2026
Researcher: Muni Nitish Kumar Yaddala
Fluent Forms <= 6.2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Subscription Cancellation
4.3
CVE-2026-11880
Aug 10, 2026
Researcher: Pedro Pinho
Fluent Forms <= 6.2.8 - Unauthenticated Sensitive Information Exposure via Insecure Direct Object Reference and Weak Transaction Hash in 'transaction' Parameter
5.3
CVE-2026-17567
Jul 30, 2026
Researcher: ChinhNguyen
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder < 6.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2026-11881
Jul 30, 2026
Researcher: Muni Nitish Kumar Yaddala
Fluent Forms <= 6.2.7 - Unauthenticated Stored Cross-Site Scripting via Name Field Nested `password` Member
7.2
CVE-2026-16655
Jul 28, 2026
Researcher: daroo
Fluent Forms <= 6.2.1 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Subscription Cancellation via 'subscription_id'
5.4
CVE-2026-5069
Jul 9, 2026
Researcher: Fernando Mecozzi
Fluent Forms <= 6.2.0 - Authenticated (Subscriber+) Authorization Bypass via 'table' Parameter
8.2
CVE-2026-5395
May 13, 2026
Researcher: Sander Horsman
Fluent Forms <= 6.1.21 - Authenticated (Subscriber+) Authorization Bypass via 'form_id' Parameter
8.2
CVE-2026-5396
May 13, 2026
Researcher: Sander Horsman
Fluent Forms <= 6.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'permission_message' Shortcode Attribute
6.4
CVE-2026-6828
May 12, 2026
Researcher: zaim
# Title CVE ID CVSS Researchers Date
1 Fluent Forms <= 6.2.11 - Unauthenticated Stored Cross-Site Scripting via Notification Smartcode Values CVE-2026-18146 7.2 Adrien Brunner August 12, 2026
2 Fluent Forms <= 6.2.4 - Insecure Direct Object Reference to Authenticated (Form Manager+) Cross-Form Submission Entry Deletion CVE-2026-11578 4.3 Muni Nitish Kumar Yaddala August 11, 2026
3 Fluent Forms <= 6.2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Subscription Cancellation CVE-2026-11880 4.3 Pedro Pinho August 10, 2026
4 Fluent Forms <= 6.2.8 - Unauthenticated Sensitive Information Exposure via Insecure Direct Object Reference and Weak Transaction Hash in 'transaction' Parameter CVE-2026-17567 5.3 ChinhNguyen July 30, 2026
5 Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder < 6.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2026-11881 6.4 Muni Nitish Kumar Yaddala July 30, 2026
6 Fluent Forms <= 6.2.7 - Unauthenticated Stored Cross-Site Scripting via Name Field Nested `password` Member CVE-2026-16655 7.2 daroo July 28, 2026
7 Fluent Forms <= 6.2.1 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Subscription Cancellation via 'subscription_id' CVE-2026-5069 5.4 Fernando Mecozzi July 9, 2026
8 Fluent Forms <= 6.2.0 - Authenticated (Subscriber+) Authorization Bypass via 'table' Parameter CVE-2026-5395 8.2 Sander Horsman May 13, 2026
9 Fluent Forms <= 6.1.21 - Authenticated (Subscriber+) Authorization Bypass via 'form_id' Parameter CVE-2026-5396 8.2 Sander Horsman May 13, 2026
10 Fluent Forms <= 6.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'permission_message' Shortcode Attribute CVE-2026-6828 6.4 zaim May 12, 2026
View more vulnerabilities in this software package View more vulnerabilities

This record contains material that is subject to copyright.

Copyright 2012-2026 Defiant Inc.

License: Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Read more.

Copyright 1999-2026 The MITRE Corporation

License: CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Read more.

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation