sales@hackhalt.com
Free Download

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total37
Critical2
High8
Medium27
Reset
Showing 1-20 of 37 records
Threat Entry Updated 2026-10-10

Fluentform - Security Vulnerability (CVE-2026-15178)

The Fluent Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.2.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Custom-level access and above, to read private form submissions, change submission statuses, permanently delete submissions, and modify global plugin settings.

PLUGIN Fluentform

CVE-2026-15178

MEDIUM CVSS 5.4 2026-10-10
Open Full Technical Breakdown
Threat Entry Updated 2026-10-11

Fluentform - Security Vulnerability (CVE-2026-101324)

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'any attacker-chosen name matching the {get.NAME} placeholder (PoC uses 'proof')' parameter in all versions up to, and including, 6.2.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires a site administrator to…

PLUGIN Fluentform

CVE-2026-101324

MEDIUM CVSS 4.7 2026-10-10
Open Full Technical Breakdown
Threat Entry Updated 2026-09-09

Fluentform - Security Vulnerability (CVE-2026-73532)

Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file (libs/class-license-sync.php), loaded via a require_once directive added to fluentformpro.php, that established a backdoor REST API endpoint, dropped persistent PHP files in mu-plugins and uploads directories, installed a passwordless administrator account, and registered scheduled tasks that survived plugin removal.

PLUGIN Fluentform

CVE-2026-73532

CRITICAL CVSS 9.3 2026-08-13
Open Full Technical Breakdown
Threat Entry Updated 2026-08-14

Fluentform - Cross-Site Scripting (XSS) (CVE-2026-18146)

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Notification Smartcode Values in all versions up to, and including, 6.2.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in the browser of an administrator (or any user with the Fluent Forms entry-viewing capability) when they view the form's entry Submission Logs in the WordPress admin dashboard. Exploitation requires that a site administrator…

PLUGIN Fluentform

CVE-2026-18146

HIGH CVSS 7.2 2026-08-13
Open Full Technical Breakdown
Threat Entry Updated 2026-08-12

Fluentform - Cross-Site Scripting (XSS) (CVE-2026-17571)

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'param' in all versions up to, and including, 6.2.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

PLUGIN Fluentform

CVE-2026-17571

MEDIUM CVSS 6.1 2026-08-01
Open Full Technical Breakdown
Threat Entry Updated 2026-08-12

Fluentform - Security Vulnerability (CVE-2026-17567)

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.2.8 via the 'transaction' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to brute-force valid transaction hashes and view sensitive payment receipt data including customer name, email address, billing address, order items, payment method, and payment status belonging to other users. Because submission ID, form ID, and transaction creation time are…

PLUGIN Fluentform

CVE-2026-17567

MEDIUM CVSS 5.3 2026-07-31
Open Full Technical Breakdown
Threat Entry Updated 2026-07-30

Fluentform - Cross-Site Scripting (XSS) (CVE-2026-16655)

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Name Field Nested `password` Member in all versions up to, and including, 6.2.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Fluentform

CVE-2026-16655

HIGH CVSS 7.2 2026-07-29
Open Full Technical Breakdown
Threat Entry Updated 2026-07-10

Fluentform - Broken Access Control (CVE-2026-5069)

The Fluent Forms plugin for WordPress is vulnerable to incorrect authorization via the 'subscription_id' parameter in versions up to, and including, 6.2.1. This is due to insufficient ownership authorization checks in the payment cancellation AJAX flow. This makes it possible for authenticated attackers, with subscriber-level access and above, to submit cancellation requests for other users' subscriptions.

PLUGIN Fluentform

CVE-2026-5069

MEDIUM CVSS 5.4 2026-07-10
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Fluentform - Security Vulnerability (CVE-2026-5395)

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.2.0 via the exportEntries function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Fluent Forms manager-level access and above, to bypass form-level access restrictions to access submissions from forms they are not authorized to view, export data from arbitrary database tables, and enumerate database table names via error message disclosure.

PLUGIN Fluentform

CVE-2026-5395

HIGH CVSS 8.2 2026-05-14
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Fluentform - Cross-Site Scripting (XSS) (CVE-2026-6828)

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'permission_message' parameter in all versions up to, and including, 6.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Fluentform

CVE-2026-6828

MEDIUM CVSS 6.4 2026-05-13
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Fluentform - Security Vulnerability (CVE-2026-6344)

The Fluent Forms plugin for WordPress is vulnerable to Arbitrary File Read in versions up to and including 6.2.1. This is due to insufficient path validation in the getAttachments() method of EmailNotificationActions, which resolves attacker-supplied file-upload URLs into filesystem paths without verifying that the resolved path stays inside the WordPress uploads directory: a strpos() prefix check on the raw URL can be bypassed with traversal sequences, wp_normalize_path() does not resolve ".\..\" segments, and file_exists() then resolves them at the kernel level. This makes it possible for authenticated attackers with administrator…

PLUGIN Fluentform

CVE-2026-6344

MEDIUM CVSS 4.9 2026-05-06
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Fluentform - Broken Access Control (CVE-2026-4160)

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'submission_id' parameter in versions up to, and including, 6.1.21. This is due to missing authorization and ownership validation on a user controlled key in the Stripe SCA confirmation AJAX endpoint. This makes it possible for unauthenticated attackers to modify payment status of targeted pending submissions (for example, setting the status to "failed").

PLUGIN Fluentform

CVE-2026-4160

MEDIUM CVSS 5.3 2026-04-16
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Fluentform - Cross-Site Scripting (XSS) (CVE-2026-2365)

The Fluent Forms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `fluentform_step_form_save_data` AJAX action in all versions up to, and including, 6.1.17. This is due to the draft form submission endpoint being publicly accessible without authentication or nonce verification, combined with insufficient input sanitization and output escaping of form field data. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrator views a partial form entry.

PLUGIN Fluentform

CVE-2026-2365

HIGH CVSS 7.2 2026-03-05
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Fluentform - Broken Access Control (CVE-2026-0996)

The Fluent Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the AI Form Builder module in all versions up to, and including, 6.1.14 due to a combination of missing authorization checks, a leaked nonce, and insufficient input sanitization. The vulnerability allows Subscriber-level users to trigger AI form generation via a protected endpoint. When prompted, AI services will typically return bare JavaScript code (without tags), which bypasses the plugin's sanitization. This stored JavaScript executes whenever anyone views the generated form, making it possible for authenticated attackers with Subscriber-level…

PLUGIN Fluentform

CVE-2026-0996

MEDIUM CVSS 6.4 2026-02-10
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Fluentform - Broken Access Control (CVE-2025-13722)

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 6.1.7. This is due to missing capability checks on the `fluentform_ai_create_form` AJAX action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary forms via the publicly exposed AI builder.

PLUGIN Fluentform

CVE-2025-13722

MEDIUM CVSS 5.3 2026-01-07
Open Full Technical Breakdown

WordPress security that blocks attacks before they land.

sales@hackhalt.com

Product

Resources

Company

© Hack Halt Inc. All rights reserved.