Fluent Forms (<= 6.2.11) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/fluent-forms--6.2.11/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 13 Aug 2026 08:54:48 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgStored XSS in Fluent Forms WordPress Plugin via Notification Smartcodeshttps://feed.craftedsignal.io/briefs/2026-08-fluent-forms-xss/Thu, 13 Aug 2026 08:54:48 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-fluent-forms-xss/An unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in Fluent Forms versions up to 6.2.11 allows attackers to inject malicious scripts that execute in the context of administrative users viewing submission logs.The Fluent Forms - Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is affected by a stored Cross-Site Scripting (XSS) vulnerability (CVE-2026-18146). The vulnerability stems from inadequate input sanitization and output escaping when processing Notification Smartcode values. Unauthenticated attackers can exploit this by submitting forms containing malicious payloads designed to be interpreted as Smartcodes. If an administrator or a user with entry-viewing permissions accesses the Submission Logs within the WordPress admin dashboard, the injected script executes in their browser session. This vulnerability impacts all versions of the plugin up to and including 6.2.11.

Impact

Successful exploitation leads to the execution of arbitrary JavaScript within the administrative context of the WordPress dashboard. This can be used to perform actions on behalf of the administrator, such as creating new administrative accounts, modifying plugin configurations, or redirecting users to malicious sites, potentially leading to a full site compromise.

Recommendation

  • Update the Fluent Forms WordPress plugin to the latest version immediately to remediate CVE-2026-18146.
  • Audit WordPress administrative logs for unusual activity originating from the plugin's submission management interface.
  • Review all configured form notifications to identify potential misuse of Smartcode fields that may be reachable by unauthenticated form submitters.
]]>highadvisory