Security Alert Summary
The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress contains a stored cross-site scripting vulnerability in Notification Smartcode values. Insufficient input sanitization and output escaping can allow unauthenticated attackers to inject scripts that execute in the browser of any user with the Fluent Forms entry-viewing capability when viewing form Submission Logs in the WordPress admin.
CVE Details
- CVE ID: CVE-2026-18146
- Affected component: Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder (plugin)
- Affected versions: All versions up to and including 6.2.11
- Published: August 13, 2026 at 07:17:06 AM UTC
- Last modified: August 13, 2026 at 01:17:48 PM UTC
- CVSS v3.1:
- Base score: 7.2
- Severity: HIGH
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N - Attack vector: Network
- Attack complexity: Low
- Privileges required: None
- User interaction: None
- Scope: Changed
- Impact: Confidentiality: Low, Integrity: Low, Availability: None
- Authentication / Privileges / User interaction: No authentication or privileges are required; exploitation occurs without user interaction given the specific notification configuration.
- CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation – Cross-site Scripting)
Technical Details
The plugin fails to sufficiently sanitize and escape Notification Smartcode values used in email notification fields. When a notification subject or a static Send To value includes a Smartcode that can be influenced by attacker-controlled input (for example, an input_password field value, a cookie value, or submission.response), an attacker can store JavaScript payloads that are later rendered unsafely in the admin Submission Logs view. The vulnerability is a stored cross-site scripting (XSS) issue: injected scripts execute in the browser of any user who views the affected entry.
Code references point to shortcode parsing and notification handling components (for example, ShortCodeParser.php and EmailNotification.php), and the admin entries script used to display submissions. The issue stems from missing or insufficient input sanitization and output escaping in the flow that parses smartcodes and renders entry values in the admin UI.
Impact is limited to script execution in the context of the admin user viewing entries. That can be used to read or act on data accessible to the administrator’s browser session, but does not by itself indicate remote code execution on the server.
How This Could Impact Your Website
Consider a typical site with a site owner, internal staff who manage forms, and external contributors who submit entries. An attacker could submit a form containing a malicious Smartcode payload in a field or manipulate a cookie or submission response value. If an administrator or a Fluent Forms manager has configured an email notification that references that Smartcode in the email subject or Send To field, viewing the Submission Logs in the WordPress admin could execute the payload in the viewer’s browser.
- Internal staff or administrators who review form submissions could have their browser sessions exposed to script-based actions.
- Disclosure of values visible in the admin interface could include internal email addresses or other submission data, increasing the risk of targeted phishing or social engineering against staff.
- Attackers could use the XSS vector to perform actions available to the viewing user in the browser (constrained by that user’s privileges and available client-side capabilities).
If you\’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review of your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributors and any accounts with entry-viewing capability.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins.
- Monitor site activity and admin logins for unusual behavior, especially around form submission and entry views.
If you\’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/fluentform/tags/6.2.8/app/Services/FormBuilder/Notifications/EmailNotification.php#L196
- https://plugins.trac.wordpress.org/browser/fluentform/tags/6.2.8/app/Services/FormBuilder/ShortCodeParser.php#L142
- https://plugins.trac.wordpress.org/browser/fluentform/tags/6.2.8/app/Services/FormBuilder/ShortCodeParser.php#L145
- https://plugins.trac.wordpress.org/browser/fluentform/tags/6.2.8/assets/js/form_entries.js#L2
- https://plugins.trac.wordpress.org/browser/fluentform/tags/6.2.8/boot/globals.php#L98
- https://plugins.trac.wordpress.org/changeset/3640683/fluentform/trunk/app/Services/FormBuilder/ShortCodeParser.php
- https://plugins.trac.wordpress.org/changeset?old_path=%2Ffluentform/tags%2F6.2.11&new_path=%2Ffluentform/tags%2F6.2.12
- https://plugins.trac.wordpress.org/changeset?reponame=&new=3640683%40fluentform%2Ftags%2F6.2.12&old=3632883%40fluentform%2Ftags%2F6.2.11
- https://www.wordfence.com/threat-intel/vulnerabilities/id/643f92e2-b14e-4056-97fc-1c631027c54f?source=cve
