Cross-site Scripting Vulnerability in NotFound Rebrand Fluent Forms

CVE-2025-23904

Summary

A Cross-site Scripting (XSS) vulnerability exists in the NotFound Rebrand Fluent Forms plugin, affecting versions from n/a to 1.0. This flaw allows attackers to exploit improper input neutralization during web page generation, enabling reflected XSS attacks. Users may be at risk if an attacker can craft malicious links that, when clicked, execute arbitrary JavaScript in the context of the victim's browser, potentially leading to data theft or session hijacking.

References