Reflected Cross-Site Scripting in Fluent Forms Plugin by WordPress
CVE-2026-101324

4.7MEDIUM

Key Information:

Vendor

WordPress
Status
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
Vendor
CVE Published:
10 October 2026

What is CVE-2026-101324?

The Fluent Forms plugin for WordPress is susceptible to a Reflected Cross-Site Scripting (XSS) vulnerability through the 'any attacker-chosen name matching the {get.NAME} placeholder' parameter. This flaw arises in all versions up to and including 6.2.14 due to inadequate input sanitization and output escaping, allowing unauthenticated attackers to inject malicious web scripts. Successful exploitation hinges on a site administrator configuring a Custom HTML field on a published form that incorporates the {get.*} SmartCode in a URL-accepting attribute, such as iframe src or a href, potentially tricking users into executing the malicious script through simple interactions like clicking on a link.

Affected Version(s)

Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder 0 <= 6.2.14

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/fluentform/tag...
https://plugins.trac.wordpress.org/browser/fluentform/tag...

CVSS V3.1

Score:
4.7
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Santh
.