Executive brief
Fluent Forms is a popular WordPress plugin used to create contact forms, surveys, and quizzes. A security flaw in this plugin allows attackers to inject malicious scripts into a user's browser if the user clicks a specially crafted link. This could lead to unauthorized actions being performed on behalf of the user or the theft of sensitive session information.
Technical details
The Fluent Forms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on the 'param' parameter within the Component.php module. An unauthenticated attacker can exploit this by crafting a malicious URL containing a script payload and tricking a victim into clicking it. When the victim visits the link, the script executes within the context of their browser session. This can be used to steal session cookies or perform actions as the authenticated user. The issue is fixed in version 6.2.9.
Affected products
- wpmanageninja Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder up to, and including, 6.2.8
Timeline
- 2026-08-01: disclosed
- 2026-08-01: advisory
- 2026-08-01: patched: Fixed in version 6.2.9
References
- https://plugins.trac.wordpress.org/browser/fluentform/tags/6.2.8/app/Modules/Component/Component.php
- https://plugins.trac.wordpress.org/browser/fluentform/tags/6.2.8/app/Modules/Component/Component.php
- https://plugins.trac.wordpress.org/changeset/3625751/fluentform/trunk/app/Modules/Component/Component.php
- https://plugins.trac.wordpress.org/changeset?old_path=%2Ffluentform/tags/6.2.8&new_path=%2Ffluentform/tags/6.2.9
- https://www.wordfence.com/threat-intel/vulnerabilities/id/547008fe-2585-4089-a710-71a83ae3d829?source=cve