Stored XSS in Fluent Forms WordPress Plugin via Notification Smartcodes

The Fluent Forms - Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is affected by a stored Cross-Site Scripting (XSS) vulnerability (CVE-2026-18146). The vulnerability stems from inadequate input sanitization and output escaping when processing Notification Smartcode values. Unauthenticated attackers can exploit this by submitting forms containing malicious payloads designed to be interpreted as Smartcodes. If an administrator or a user with entry-viewing permissions accesses the Submission Logs within the WordPress admin dashboard, the injected script executes in their browser session. This vulnerability impacts all versions of the plugin up to and including 6.2.11.

Impact

Successful exploitation leads to the execution of arbitrary JavaScript within the administrative context of the WordPress dashboard. This can be used to perform actions on behalf of the administrator, such as creating new administrative accounts, modifying plugin configurations, or redirecting users to malicious sites, potentially leading to a full site compromise.

Recommendation

• Update the Fluent Forms WordPress plugin to the latest version immediately to remediate CVE-2026-18146.
• Audit WordPress administrative logs for unusual activity originating from the plugin's submission management interface.
• Review all configured form notifications to identify potential misuse of Smartcode fields that may be reachable by unauthenticated form submitters.