Refine your search

5 vulnerabilities found for Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder by wpmanageninja

CVE-2026-18146 (GCVE-0-2026-18146)
Vulnerability from cvelistv5
Published
2026-08-13 06:38
Modified
2026-08-13 13:00
Severity ?
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Summary
The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Notification Smartcode Values in all versions up to, and including, 6.2.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in the browser of an administrator (or any user with the Fluent Forms entry-viewing capability) when they view the form's entry Submission Logs in the WordPress admin dashboard. Exploitation requires that a site administrator or Fluent Forms manager has configured an email notification whose subject or static (direct) Send To value references an attacker-influenced Smartcode such as an input_password field value, a cookie value, or submission.response.
References
Impacted products
Vendor Product Version
wpmanageninja Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder Version: 0   ≤ 6.2.11
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-18146",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-13T13:00:41.828651Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-13T13:00:48.626Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, \u0026 Conversational Form Builder",
          "vendor": "wpmanageninja",
          "versions": [
            {
              "lessThanOrEqual": "6.2.11",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Adrien Brunner"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, \u0026 Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Notification Smartcode Values in all versions up to, and including, 6.2.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in the browser of an administrator (or any user with the Fluent Forms entry-viewing capability) when they view the form\u0027s entry Submission Logs in the WordPress admin dashboard. Exploitation requires that a site administrator or Fluent Forms manager has configured an email notification whose subject or static (direct) Send To value references an attacker-influenced Smartcode such as an input_password field value, a cookie value, or submission.response."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-13T06:38:30.491Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/643f92e2-b14e-4056-97fc-1c631027c54f?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/fluentform/tags/6.2.8/app/Services/FormBuilder/Notifications/EmailNotification.php#L196"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/fluentform/tags/6.2.8/boot/globals.php#L98"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/fluentform/tags/6.2.8/app/Services/FormBuilder/ShortCodeParser.php#L145"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/fluentform/tags/6.2.8/app/Services/FormBuilder/ShortCodeParser.php#L142"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/fluentform/tags/6.2.8/assets/js/form_entries.js#L2"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3640683%40fluentform%2Ftags%2F6.2.12\u0026old=3632883%40fluentform%2Ftags%2F6.2.11"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3640683/fluentform/trunk/app/Services/FormBuilder/ShortCodeParser.php"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?old_path=%2Ffluentform/tags/6.2.11\u0026new_path=%2Ffluentform/tags/6.2.12"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-07-28T19:13:22.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-08-12T18:34:04.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Fluent Forms \u003c= 6.2.11 - Unauthenticated Stored Cross-Site Scripting via Notification Smartcode Values"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-18146",
    "datePublished": "2026-08-13T06:38:30.491Z",
    "dateReserved": "2026-07-28T18:58:05.758Z",
    "dateUpdated": "2026-08-13T13:00:48.626Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-17571 (GCVE-0-2026-17571)
Vulnerability from cvelistv5
Published
2026-08-01 08:32
Modified
2026-08-03 19:02
Severity ?
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Summary
The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'param' in all versions up to, and including, 6.2.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
References
Impacted products
Vendor Product Version
wpmanageninja Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder Version: 0   ≤ 6.2.8
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-17571",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-03T19:02:02.985156Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-03T19:02:11.226Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, \u0026 Conversational Form Builder",
          "vendor": "wpmanageninja",
          "versions": [
            {
              "lessThanOrEqual": "6.2.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Osvaldo Noe Gonzalez Del Rio (Os)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, \u0026 Conversational Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via \u0027param\u0027 in all versions up to, and including, 6.2.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-01T08:32:27.506Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/547008fe-2585-4089-a710-71a83ae3d829?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/fluentform/tags/6.2.8/app/Modules/Component/Component.php#L1456"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/fluentform/tags/6.2.8/app/Modules/Component/Component.php#L1452"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?old_path=%2Ffluentform/tags/6.2.8\u0026new_path=%2Ffluentform/tags/6.2.9"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3625751/fluentform/trunk/app/Modules/Component/Component.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-07-27T15:21:42.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-07-31T19:54:23.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Fluent Forms \u003c= 6.2.8 - Reflected Cross-Site Scripting via \u0027param\u0027"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-17571",
    "datePublished": "2026-08-01T08:32:27.506Z",
    "dateReserved": "2026-07-27T15:06:12.769Z",
    "dateUpdated": "2026-08-03T19:02:11.226Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-17567 (GCVE-0-2026-17567)
Vulnerability from cvelistv5
Published
2026-07-31 09:32
Modified
2026-07-31 23:25
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE
  • CWE-639 - Authorization Bypass Through User-Controlled Key
Summary
The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.2.8 via the 'transaction' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to brute-force valid transaction hashes and view sensitive payment receipt data including customer name, email address, billing address, order items, payment method, and payment status belonging to other users. Because submission ID, form ID, and transaction creation time are either observable or guessable by an attacker, the effective brute-force space is bounded to approximately 900 candidates per second per (submission, form) pair, making exploitation practical without any prior authentication or account.
References
Impacted products
Vendor Product Version
wpmanageninja Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder Version: 0   ≤ 6.2.8
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-17567",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-31T23:25:12.292057Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-31T23:25:22.575Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, \u0026 Conversational Form Builder",
          "vendor": "wpmanageninja",
          "versions": [
            {
              "lessThanOrEqual": "6.2.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "ChinhNguyen"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, \u0026 Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.2.8 via the \u0027transaction\u0027 parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to brute-force valid transaction hashes and view sensitive payment receipt data including customer name, email address, billing address, order items, payment method, and payment status belonging to other users. Because submission ID, form ID, and transaction creation time are either observable or guessable by an attacker, the effective brute-force space is bounded to approximately 900 candidates per second per (submission, form) pair, making exploitation practical without any prior authentication or account."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-31T09:32:01.350Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/565980d7-8dc9-42a4-90c5-2f75af52fb8e?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/fluentform/tags/6.2.4/app/Modules/Payments/PaymentMethods/BaseProcessor.php#L959"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/fluentform/tags/6.2.8/app/Modules/Payments/PaymentMethods/BaseProcessor.php#L959"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/fluentform/tags/6.2.8/app/Modules/Payments/TransactionShortcodes.php#L107"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/fluentform/tags/6.2.8/app/Modules/Payments/PaymentHandler.php#L218"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/fluentform/tags/6.2.4/app/Modules/Payments/TransactionShortcodes.php#L107"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/fluentform/tags/6.2.4/app/Modules/Payments/PaymentHandler.php#L218"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?old_path=%2Ffluentform/tags/6.2.8\u0026new_path=%2Ffluentform/tags/6.2.9"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3625751/fluentform/trunk/app/Modules/Payments/PaymentMethods/BaseProcessor.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-07-27T15:00:37.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-07-30T21:02:53.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Fluent Forms \u003c= 6.2.8 - Unauthenticated Sensitive Information Exposure via Insecure Direct Object Reference and Weak Transaction Hash in \u0027transaction\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-17567",
    "datePublished": "2026-07-31T09:32:01.350Z",
    "dateReserved": "2026-07-27T14:45:05.088Z",
    "dateUpdated": "2026-07-31T23:25:22.575Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-16655 (GCVE-0-2026-16655)
Vulnerability from cvelistv5
Published
2026-07-29 09:31
Modified
2026-07-29 12:24
Severity ?
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Summary
The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Name Field Nested `password` Member in all versions up to, and including, 6.2.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
References
https://www.wordfence.com/threat-intel/vulnerabilities/id/635e19ba-da98-459c-ab91-ff969b0812fd?source=cve
https://plugins.trac.wordpress.org/browser/fluentform/tags/6.2.7/boot/globals.php#L110
https://plugins.trac.wordpress.org/browser/fluentform/tags/6.2.7/app/Hooks/Ajax.php#L17
https://plugins.trac.wordpress.org/browser/fluentform/tags/6.2.7/app/Modules/SubmissionHandler/SubmissionHandler.php#L20
https://plugins.trac.wordpress.org/browser/fluentform/tags/6.2.7/app/Services/Form/SubmissionHandlerService.php#L123
https://plugins.trac.wordpress.org/browser/fluentform/tags/6.2.7/app/Modules/Form/FormDataParser.php#L317
https://plugins.trac.wordpress.org/browser/fluentform/tags/6.2.7/app/Services/Integrations/GlobalNotificationService.php#L59
https://plugins.trac.wordpress.org/browser/fluentform/tags/6.2.6/boot/globals.php#L110
https://plugins.trac.wordpress.org/browser/fluentform/tags/6.2.6/app/Hooks/Ajax.php#L17
https://plugins.trac.wordpress.org/browser/fluentform/tags/6.2.6/app/Modules/SubmissionHandler/SubmissionHandler.php#L20
https://plugins.trac.wordpress.org/browser/fluentform/tags/6.2.6/app/Services/Form/SubmissionHandlerService.php#L123
https://plugins.trac.wordpress.org/browser/fluentform/tags/6.2.6/app/Modules/Form/FormDataParser.php#L317
https://plugins.trac.wordpress.org/browser/fluentform/tags/6.2.6/app/Services/Integrations/GlobalNotificationService.php#L59
https://plugins.trac.wordpress.org/changeset/3619584/fluentform/trunk/boot/globals.php
https://plugins.trac.wordpress.org/changeset?old_path=%2Ffluentform/tags/6.2.7&new_path=%2Ffluentform/tags/6.2.8
Impacted products
Vendor Product Version
wpmanageninja Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder Version: 0   ≤ 6.2.7
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-16655",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-29T12:22:47.632863Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-29T12:24:03.916Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, \u0026 Conversational Form Builder",
          "vendor": "wpmanageninja",
          "versions": [
            {
              "lessThanOrEqual": "6.2.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "daroo"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, \u0026 Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Name Field Nested `password` Member in all versions up to, and including, 6.2.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-29T09:31:14.503Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/635e19ba-da98-459c-ab91-ff969b0812fd?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/fluentform/tags/6.2.7/boot/globals.php#L110"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/fluentform/tags/6.2.7/app/Hooks/Ajax.php#L17"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/fluentform/tags/6.2.7/app/Modules/SubmissionHandler/SubmissionHandler.php#L20"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/fluentform/tags/6.2.7/app/Services/Form/SubmissionHandlerService.php#L123"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/fluentform/tags/6.2.7/app/Modules/Form/FormDataParser.php#L317"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/fluentform/tags/6.2.7/app/Services/Integrations/GlobalNotificationService.php#L59"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/fluentform/tags/6.2.6/boot/globals.php#L110"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/fluentform/tags/6.2.6/app/Hooks/Ajax.php#L17"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/fluentform/tags/6.2.6/app/Modules/SubmissionHandler/SubmissionHandler.php#L20"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/fluentform/tags/6.2.6/app/Services/Form/SubmissionHandlerService.php#L123"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/fluentform/tags/6.2.6/app/Modules/Form/FormDataParser.php#L317"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/fluentform/tags/6.2.6/app/Services/Integrations/GlobalNotificationService.php#L59"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3619584/fluentform/trunk/boot/globals.php"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?old_path=%2Ffluentform/tags/6.2.7\u0026new_path=%2Ffluentform/tags/6.2.8"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-07-22T19:42:13.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-07-28T20:38:26.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Fluent Forms \u003c= 6.2.7 - Unauthenticated Stored Cross-Site Scripting via Name Field Nested `password` Member"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-16655",
    "datePublished": "2026-07-29T09:31:14.503Z",
    "dateReserved": "2026-07-22T19:21:47.424Z",
    "dateUpdated": "2026-07-29T12:24:03.916Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-5069 (GCVE-0-2026-5069)
Vulnerability from cvelistv5
Published
2026-07-10 02:30
Modified
2026-07-10 18:02
Severity ?
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
CWE
  • CWE-863 - Incorrect Authorization
Summary
The Fluent Forms plugin for WordPress is vulnerable to incorrect authorization via the 'subscription_id' parameter in versions up to, and including, 6.2.1. This is due to insufficient ownership authorization checks in the payment cancellation AJAX flow. This makes it possible for authenticated attackers, with subscriber-level access and above, to submit cancellation requests for other users' subscriptions.
References
Impacted products
Vendor Product Version
wpmanageninja Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder Version: 0   ≤ 6.2.1
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-5069",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-10T18:02:33.208787Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-10T18:02:38.866Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, \u0026 Conversational Form Builder",
          "vendor": "wpmanageninja",
          "versions": [
            {
              "lessThanOrEqual": "6.2.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Fernando Mecozzi"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Fluent Forms plugin for WordPress is vulnerable to incorrect authorization via the \u0027subscription_id\u0027 parameter in versions up to, and including, 6.2.1. This is due to insufficient ownership authorization checks in the payment cancellation AJAX flow. This makes it possible for authenticated attackers, with subscriber-level access and above, to submit cancellation requests for other users\u0027 subscriptions."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-10T02:30:39.977Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e7521577-ce13-4b60-ae11-9c0f9c077cf9?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3513845/fluentform"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-03-27T23:09:08.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-07-09T13:51:54.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Fluent Forms \u003c= 6.2.1 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Subscription Cancellation via \u0027subscription_id\u0027"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-5069",
    "datePublished": "2026-07-10T02:30:39.977Z",
    "dateReserved": "2026-03-27T22:53:28.217Z",
    "dateUpdated": "2026-07-10T18:02:38.866Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}