Fluent Forms Pro Add On Pack

Fluent Forms Pro Add On Pack has 9 disclosed vulnerabilities in the WordSec catalog, all reported in 2026; all 9 are fixed as of September 2026. Their average CVSS score is 7.1, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 4 high. 2026 was the busiest year with 9 disclosures.

The most common weakness is Cross-Site Scripting, behind 2 of the records (22%). Other recurring categories include Missing Authorization, Deserialization Of Untrusted Data.

Every one of the 9 issues recorded for Fluent Forms Pro Add On Pack has a vendor fix available, so running the current release closes all known holes.

4 independent researchers contributed these findings, most of them (3) reported by Prickly Cactus.

Strategic Overview

Avg CVSSHigh

7.1/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Fluent Forms Pro Add On Pack vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2026-73532

Fluent Forms Pro 6.2.7 & Ninja Tables Pro 5.2.13 - Remote Code Execution via Backdoor

Read the full analysis

Vulnerability Records

9 records


2026-08-28 00:00	Fluent Forms Pro Add On Pack <= 6.2.12 - Missing Authorization Fluent Forms Pro Add On Pack <= 6.2.12	`CVE-2026-81296`	5.3 Medium	Ananda Dhakal	Yes
2026-08-28 00:00	Fluent Forms Pro Add On Pack <= 6.2.12 - Authenticated (Subscriber+) Privilege Escalation Fluent Forms Pro Add On Pack <= 6.2.12	`CVE-2026-81297`	6.3 Medium	Ananda Dhakal	Yes
2026-08-18 00:00	Fluent Forms Pro Add On Pack < 6.2.12 - Unauthenticated Stored Cross-Site Scripting Fluent Forms Pro Add On Pack < 6.2.12	`CVE-2026-66633`	7.2 High	daroo	Yes
2026-08-03 00:00	Fluent Forms Pro 6.2.7 & Ninja Tables Pro 5.2.13 - Remote Code Execution via Backdoor Fluent Forms Pro Add On Pack 6.2.7	`CVE-2026-73532`	9.8 Critical	Anonymous	Yes
2026-07-25 12:00	Fluent Forms Pro Add On Pack <= 6.2.6 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary User Password Change via User Meta Field Fluent Forms Pro Add On Pack <= 6.2.6	`CVE-2026-15962`	8.8 High	daroo	Yes
2026-03-04 14:34	Fluent Forms Pro Add On Pack <= 6.1.17 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion Fluent Forms Pro Add On Pack <= 6.1.17	`CVE-2026-2899`	6.5 Medium	Prickly Cactus	Yes
2026-03-04 14:28	Fluent Forms Pro <= 6.1.17 - Unauthenticated Stored Cross-Site Scripting via Draft Form Submission Fluent Forms Pro Add On Pack <= 6.1.17	`CVE-2026-2365`	7.2 High	Prickly Cactus	Yes
2026-02-26 14:33	Fluent Forms Pro Add On Pack <= 6.1.17 - Missing Authorization to Unauthenticated Payment Status modification Fluent Forms Pro Add On Pack <= 6.1.17	`CVE-2026-2428`	7.5 High	Prickly Cactus	Yes
2026-02-08 22:49	Fluent Forms Pro Add On Pack <= 6.1.12 - Authenticated (Subscriber+) Server-Side Request Forgery via 'saveDataSource' Fluent Forms Pro Add On Pack <= 6.1.12	`CVE-2026-0632`	5.4 Medium	andrea bocchetti	Yes

Showing 1–9 of 9 reports