Description

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Notification Smartcode Values in all versions up to, and including, 6.2.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in the browser of an administrator (or any user with the Fluent Forms entry-viewing capability) when they view the form's entry Submission Logs in the WordPress admin dashboard. Exploitation requires that a site administrator or Fluent Forms manager has configured an email notification whose subject or static (direct) Send To value references an attacker-influenced Smartcode such as an input_password field value, a cookie value, or submission.response.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-13T07:17:06.523Z",
  "pubdate": "2026-08-13T07:17:06.523Z",
  "executiveSummary": "The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. This security flaw exists in all versions up to, and including, 6.2.11 due to a lack of proper input sanitization and output escaping mechanisms applied to Notification Smartcode Values. The primary impact of this vulnerability is the execution of arbitrary web scripts within the administrative context of a targeted WordPress site, specifically when a privileged user reviews submission logs. Unauthenticated attackers can exploit this flaw provided specific misconfigurations or configurations exist. The risk implications are severe, as successful exploitation allows malicious actors to leverage the administrative session to perform unauthorized actions, potentially leading to full site compromise, data exfiltration, or further malware injection. Exploitation requires that a site administrator or Fluent Forms manager has configured an email notification whose subject or static (direct) Send To value references an attacker-influenced Smartcode, such as an input_password field value, a cookie value, or submission.response. Without these conditions met, the vector remains unexploitable despite the underlying flaw in the parsing and rendering logic of the notification system.",
  "technicalDetails": "The root cause of the vulnerability resides in the insufficient input sanitization and output escaping procedures implemented within the Notification Smartcode processing component of the Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin. When form submissions are processed, the application parses various Smartcodes embedded within notification configurations. Due to the absence of rigorous sanitization upon intake and proper contextual output escaping during rendering, malicious payloads injected into input vectors can be persisted within the database.\nThe vulnerable component is the notification handling and submission logging subsystem, which processes and displays Smartcode values such as input_password field values, cookie values, or submission.response parameters. The affected versions include all releases of the plugin up to, and including, 6.2.11. The authentication and privilege requirements for the exploitation vector are asymmetric: the initial injection of the malicious Smartcode payload can be performed by unauthenticated attackers via user-supplied input fields or manipulated request parameters (such as cookies or specific form fields). However, the execution phase requires interaction from a high-privilege user, specifically an administrator or any user possessing the Fluent Forms entry-viewing capability, who subsequently accesses the form's entry Submission Logs within the WordPress admin dashboard.\nThe attack flow proceeds in a sequential, multi-stage manner. First, an unauthenticated attacker crafts a malicious payload containing arbitrary JavaScript and injects it into an input vector that maps to an attacker-influenced Smartcode, such as a password field, a cookie, or a submission response parameter. Second, this payload is processed by the plugin and stored within the database as part of the submission or notification context. Third, the exploitation mechanism relies on a site administrator or Fluent Forms manager having previously configured an email notification whose subject or static (direct) Send To value references the specific attacker-influenced Smartcode. Finally, when the administrator or authorized manager navigates to the WordPress admin dashboard to view the form's entry Submission Logs, the raw, unescaped Smartcode value is rendered within the browser DOM. The embedded script executes immediately in the security context of the administrator session, enabling post-exploitation impacts such as session hijacking, administrative privilege escalation, or unauthorized modifications to the WordPress installation."
}