313 matches found
Contact Form Plugin by Fluent Forms < 5.1.17 - Unauthenticated Limited Privilege Escalation
The plugin is vulnerable to privilege escalation due to a missing capability check on the /wp-json/fluentform/v1/managers REST API endpoint. This makes it possible for unauthenticated attackers to grant users with Fluent Form management permissions which gives them access to all of the plugin's...
CVE-2026-66633
Unauthenticated Cross Site Scripting XSS in Fluent Forms Pro Add On Pack 6.2.12 versions...
CVE-2026-66633
Unauthenticated Cross Site Scripting XSS in Fluent Forms Pro Add On Pack 6.2.12 versions...
CVE-2026-66633
CVE-2026-66633 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the Fluent Forms Pro Add On Pack WordPress plugin, affecting versions prior to 6.2.12 . The flaw was discovered by daroo and assigned a CVSS 3.1 score of 7.1 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:...
CVE-2026-66633 WordPress Fluent Forms Pro Add On Pack plugin < 6.2.12 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Fluent Forms Pro Add On Pack 6.2.12 versions...
EUVD-2026-60918
Unauthenticated Cross Site Scripting XSS in Fluent Forms Pro Add On Pack 6.2.12 versions...
CVE-2026-66633 WordPress Fluent Forms Pro Add On Pack plugin < 6.2.12 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Fluent Forms Pro Add On Pack 6.2.12 versions...
WordPress Fluent Forms plugin <= 6.2.11 - Unauthenticated Stored Cross-Site Scripting via Notification Smartcode Values vulnerability
Unauthenticated Stored Cross-Site Scripting via Notification Smartcode Values vulnerability discovered by Adrien Brunner in WordPress Plugin FluentForm versions = 6.2.11...
CVE-2026-73532
Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file libs/class-license-sync.php, loaded via a requireonce directive added to fluentformpro.php,...
CVE-2026-73532
Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file libs/class-license-sync.php, loaded via a requireonce directive added to fluentformpro.php,...
EUVD-2026-58113
Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file libs/class-license-sync.php, loaded via a requireonce directive added to fluentformpro.php,...
CVE-2026-73532
Fluent Forms Pro 6.2.7 is affected by an embedded malicious-code vulnerability introduced via a tampered plugin build served from a decommissioned update server. A rogue PHP file, libs/class-license-sync.php, was loaded through a require_once in fluentformpro.php, creating a backdoor REST API end...
CVE-2026-73532 Fluent Forms Pro 6.2.7 Embedded Malicious Code via Tampered Plugin Build
Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file libs/class-license-sync.php, loaded via a requireonce directive added to fluentformpro.php,...
CVE-2026-18146
The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Notification Smartcode Values in all versions up to, and including, 6.2.11 due to insufficient input sanitization and output escaping...
CVE-2026-18146 Fluent Forms <= 6.2.11 - Unauthenticated Stored Cross-Site Scripting via Notification Smartcode Values
The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Notification Smartcode Values in all versions up to, and including, 6.2.11 due to insufficient input sanitization and output escaping...
CVE-2026-18146
The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Notification Smartcode Values in all versions up to, and including, 6.2.11 due to insufficient input sanitization and output escaping...
CVE-2026-18146
The CVE-2026-18146 entry concerns the Fluent Forms WordPress plugin (versions ≤ 6.2.11). It describes a Stored Cross‑Site Scripting vulnerability caused by insufficient input sanitization and output escaping in Notification Smartcode Values, enabling unauthenticated attackers to inject scripts th...
EUVD-2026-57736
The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Notification Smartcode Values in all versions up to, and including, 6.2.11 due to insufficient input sanitization and output escaping...
PT-2026-71689
Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file libs/class-license-sync.php, loaded via a require once directive added to fluentformpro.php...