Reflected Cross-Site Scripting Vulnerability in Fluent Forms Plugin for WordPress
CVE-2026-17571

6.1MEDIUM

Key Information:

Vendor

WordPress
Status
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
Vendor
CVE Published:
1 August 2026

What is CVE-2026-17571?

The Fluent Forms plugin, widely used for building customizable contact forms, quizzes, and surveys on WordPress sites, is susceptible to a reflected cross-site scripting vulnerability. This issue arises from inadequate input sanitization and output escaping within the plugin. Attackers can exploit this vulnerability to inject malicious scripts that execute in the context of the victim’s browser, given they can persuade a user to click on a crafted link. All versions of Fluent Forms up to and including 6.2.8 are affected, highlighting the importance of maintaining updated software and employing robust security practices.

Affected Version(s)

Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder 0 <= 6.2.8

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/fluentform/tag...
https://plugins.trac.wordpress.org/browser/fluentform/tag...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Osvaldo Noe Gonzalez Del Rio (Os)
.