WordSec
WordSec

Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder

Explore Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder vulnerabilities across all versions. Currently tracking 35 known vulnerabilities, including severity, impact, and patch status.

01234567891016.06.2021Today16.06.20218.8WP Fluent Forms < 3.6.67 - Stored Cross-Site Scripting CVSS 8.8 · 16.06.202117.10.20228.3Contact Form Plugin by FluentForm <= 4.3.12 - CSV Injection CVSS 8.3 · 17.10.202220.03.20236.4FluentForms <= 4.3.24 - Authenticated(Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 20.03.202312.07.20237.2FluentForm <= 4.3.25 - Authenticated (Administrator+) SQL Injection CVSS 7.2 · 12.07.202308.09.20235.3Contact Form for Plugin by Fluent Forms <= 5.0.8 - Insecure Direct Object Reference CVSS 5.3 · 08.09.202318.01.20244.4Fluent Forms <= 5.1.5 - Authenticated(Administrator+) Stored Cross-Site Scripting via imported form title CVSS 4.4 · 18.01.202405.03.20244.9Fluent Forms <= 5.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 4.9 · 05.03.202417.05.20246.4Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 17.05.20246.4Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting CVSS 6.4 · 17.05.20247.5Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Missing Authorization to Setting Manipulation CVSS 7.5 · 17.05.20249.8Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Missing Authorization to Settings Update and Limited Privilege Escalation CVSS 9.8 · 17.05.202421.05.20247.5Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.15 - PHP Object Injection via extractDynamicValues CVSS 7.5 · 21.05.202426.07.20244.9Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Welcome Screen Fields CVSS 4.9 · 26.07.20244.4Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Administrator+) Stored Cross-Site Scripting CVSS 4.4 · 26.07.20244.4Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Administrator+) Stored Cross-Site Scripting CVSS 4.4 · 26.07.20244.4Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Administrator+) Stored Cross-Site Scripting CVSS 4.4 · 26.07.202431.08.20244.2Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.18 - Missing Authorization to Authenticated (Subscriber+) Mailchimp Integration Modification CVSS 4.2 · 31.08.202404.10.20244.9Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Form Manager+) Stored Cross-Site Scripting CVSS 4.9 · 04.10.202418.11.20244.4Fluent Forms <= 5.2.0 - Authenticated (Admin+) Stored Cross-Site Scripting CVSS 4.4 · 18.11.202413.12.20247.2Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.2.6 - Unauthenticated Stored Cross-Site Scripting via Form Subject CVSS 7.2 · 13.12.202421.03.20255.3Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 5.2.12 - IP-Spoofing CVSS 5.3 · 21.03.202516.04.20256.4Fluent Forms <= 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 16.04.202502.09.20256.5Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder 5.1.16 - 6.1.1 - Authenticated (Subscriber+) PHP Object Injection To Arbitrary File Read CVSS 6.5 · 02.09.202505.12.20255.3Fluent Forms <= 6.1.7 - Unauthenticated Insecure Direct Object Reference to Payment Status Tampering via submission_id CVSS 5.3 · 05.12.202506.01.20265.3Fluent Forms <= 6.1.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Form Creation via AI Builder CVSS 5.3 · 06.01.202613.01.20266.5FluentForm <= 6.1.11 - Unauthenticated Arbitrary Shortcode Execution CVSS 6.5 · 13.01.202625.01.20264.3Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.1.14 - Missing Authorization CVSS 4.3 · 25.01.202609.02.20266.4Fluent Forms <= 6.1.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via AI Form Builder Module CVSS 6.4 · 09.02.202616.04.20265.3Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.1.21 - Insecure Direct Object Reference in Stripe SCA Confirmation to Unauthenticated Payment Status Modification CVSS 5.3 · 16.04.202605.05.20264.9Fluent Forms <= 6.2.1 - Authenticated (Administrator+) Arbitrary File Read via Path Traversal in Email Attachment CVSS 4.9 · 05.05.202612.05.20266.4Fluent Forms <= 6.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'permission_message' Shortcode Attribute CVSS 6.4 · 12.05.202613.05.20268.2Fluent Forms <= 6.1.21 - Authenticated (Subscriber+) Authorization Bypass via 'form_id' Parameter CVSS 8.2 · 13.05.20268.2Fluent Forms <= 6.2.0 - Authenticated (Subscriber+) Authorization Bypass via 'table' Parameter CVSS 8.2 · 13.05.202609.07.20265.4Fluent Forms <= 6.2.1 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Subscription Cancellation via 'subscription_id' CVSS 5.4 · 09.07.202628.07.20267.2Fluent Forms <= 6.2.7 - Unauthenticated Stored Cross-Site Scripting via Name Field Nested `password` Member CVSS 7.2 · 28.07.2026

Strategic Overview

Avg CVSSMedium
6.1/ 10
Patch Coverage100%
Open

0

Fixed

35

Get automatic notifications for all Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder vulnerabilities before they are exploited.

Vulnerability Records

35 records
2026-07-28 20:38
Fluent Forms <= 6.2.7 - Unauthenticated Stored Cross-Site Scripting via Name Field Nested `password` Member
Fluent Forms
<= 6.2.7
CVE-2026-16655
7.2
High
darooYes
2026-07-09 13:51
Fluent Forms <= 6.2.1 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Subscription Cancellation via 'subscription_id'
Fluent Forms
<= 6.2.1
CVE-2026-5069
5.4
Medium
Fernando MecozziYes
2026-05-13 18:08
Fluent Forms <= 6.2.0 - Authenticated (Subscriber+) Authorization Bypass via 'table' Parameter
Fluent Forms
<= 6.2.0
CVE-2026-5395
8.2
High
Sander HorsmanYes
2026-05-13 17:13
Fluent Forms <= 6.1.21 - Authenticated (Subscriber+) Authorization Bypass via 'form_id' Parameter
Fluent Forms
<= 6.1.21
CVE-2026-5396
8.2
High
Sander HorsmanYes
2026-05-12 00:00
Fluent Forms <= 6.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'permission_message' Shortcode Attribute
Fluent Forms
<= 6.2.1
CVE-2026-6828
6.4
Medium
zaimYes
2026-05-05 17:53
Fluent Forms <= 6.2.1 - Authenticated (Administrator+) Arbitrary File Read via Path Traversal in Email Attachment
Fluent Forms
<= 6.2.1
CVE-2026-6344
4.9
Medium
Niv KochanYes
2026-04-16 00:53
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.1.21 - Insecure Direct Object Reference in Stripe SCA Confirmation to Unauthenticated Payment Status Modification
Fluent Forms
6.1.21
CVE-2026-4160
5.3
Medium
Prickly CactusYes
2026-02-09 17:19
Fluent Forms <= 6.1.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via AI Form Builder Module
Fluent Forms
<= 6.1.14
CVE-2026-0996
6.4
Medium
Osvaldo Noe Gonzalez Del Rio (Os)Yes
2026-01-25 00:00
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.1.14 - Missing Authorization
Fluent Forms
<= 6.1.14
CVE-2026-25313
4.3
Medium
benzdeusYes
2026-01-13 00:00
FluentForm <= 6.1.11 - Unauthenticated Arbitrary Shortcode Execution
Fluent Forms
<= 6.1.11
CVE-2025-69001
6.5
Medium
Kishan VyasYes
Showing 1–10 of 35 reports

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C