Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder

Vulnerabilities

• CVE-2024-2771

  Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Missing Authorization to Settings Update and Limited Privilege

  Critical 9.8

• CVE-2023-24410

  WordPress FluentForm Plugin <= 4.3.25 is vulnerable to SQL Injection

  Critical 9.8

• CVE-2026-73532

  Fluent Forms Pro 6.2.7 Embedded Malicious Code via Tampered Plugin Build

  Critical 9.3

• CVE-2024-4157

  Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.15 - PHP Object Injection via extractDynamicValues

  High 8.8

• CVE-2021-34620→ 3.6.67

  CSRF in WP Fluent Forms < 3.6.67 allows stored XSS and Privilege Escalation

  High 8.8

• CVE-2026-5395

  Fluent Forms <= 6.2.0 - Authenticated (Subscriber+) Authorization Bypass via 'table' Parameter

  High 8.2

• CVE-2026-5396

  Fluent Forms <= 6.1.21 - Authenticated (Subscriber+) Authorization Bypass via 'form_id' Parameter

  High 8.2

• CVE-2024-2782

  Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Missing Authorization to Setting Manipulation

  High 7.5

• CVE-2026-18146

  Fluent Forms <= 6.2.11 - Unauthenticated Stored Cross-Site Scripting via Notification Smartcode Values

  High 7.2

• CVE-2026-16655

  Fluent Forms <= 6.2.7 - Unauthenticated Stored Cross-Site Scripting via Name Field Nested `password` Member

  High 7.2

• CVE-2026-2365

  Fluent Forms Pro <= 6.1.17 - Unauthenticated Stored Cross-Site Scripting via Draft Form Submission

  High 7.2

• CVE-2026-103343

  WordPress FluentForm plugin <= 6.2.14 - Cross Site Scripting (XSS) vulnerability

  Medium 6.5

• CVE-2025-9260

  Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder 5.1.16 - 6.1.1 - Authenticated (Subscriber+) PHP Object Injection To Arbi

  Medium 6.5

• CVE-2026-6828

  Fluent Forms <= 6.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'permission_message' Shortcode Attribute

  Medium 6.4

• CVE-2026-0996

  Fluent Forms <= 6.1.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via AI Form Builder Module

  Medium 6.4

• CVE-2025-3615

  Fluent Forms <= 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

  Medium 6.4

• CVE-2024-4709

  Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Authenticated (Contributor+) Stored Cross-Site Scripting

  Medium 6.4

• CVE-2026-17571

  Fluent Forms <= 6.2.8 - Reflected Cross-Site Scripting via 'param'

  Medium 6.1

• CVE-2024-10646

  Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.2.6 - Unauthenticated Stored Cross-Site Scripting via Form Subject

  Medium 6.1

• CVE-2026-5069

  Fluent Forms <= 6.2.1 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Subscription Cancellation via 'subscription_id'

  Medium 5.4

• CVE-2024-6703

  Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Subscriber+) Stored Cross-Site Scripting via We

  Medium 5.4

• CVE-2023-6957

  Fluent Forms <= 5.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

  Medium 5.4

• CVE-2026-103353

  WordPress FluentForm plugin <= 6.2.14 - Broken Access Control vulnerability

  Medium 5.3

• CVE-2026-17567

  Fluent Forms <= 6.2.8 - Unauthenticated Sensitive Information Exposure via Insecure Direct Object Reference and Weak Transaction Hash in 'transaction' Parameter

  Medium 5.3

• CVE-2026-4160

  Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.1.21 - Insecure Direct Object Reference in Stripe SCA Confirmation t

  Medium 5.3

• CVE-2025-69001

  WordPress FluentForm plugin <= 6.1.11 - Arbitrary Shortcode Execution vulnerability

  Medium 5.3

• CVE-2025-13722

  Fluent Forms <= 6.1.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Form Creation via AI Builder

  Medium 5.3

• CVE-2025-13748

  Fluent Forms <= 6.1.7 - Unauthenticated Insecure Direct Object Reference to Payment Status Tampering via submission_id

  Medium 5.3

• CVE-2024-13666

  Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 5.2.12 - IP-Spoofing

  Medium 5.3

• CVE-2023-41952

  WordPress Fluent Forms plugin <= 5.0.8 - Broken Access Control vulnerability

  Medium 5.3

• CVE-2026-6344

  Fluent Forms <= 6.2.1 - Authenticated (Administrator+) Arbitrary File Read via Path Traversal in Email Attachment

  Medium 4.9

• CVE-2024-9528

  Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Form Manager+) Stored Cross-Site Scripting

  Medium 4.8

• CVE-2024-0618

  Fluent Forms <= 5.1.5 - Authenticated(Administrator+) Stored Cross-Site Scripting via imported form title

  Medium 4.8

• CVE-2024-6521

  Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Administrator+) Stored Cross-Site Scripting

  Medium 4.4

• CVE-2024-6520

  Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Administrator+) Stored Cross-Site Scripting

  Medium 4.4

• CVE-2024-6518

  Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Administrator+) Stored Cross-Site Scripting

  Medium 4.4

• CVE-2026-25313

  WordPress FluentForm plugin <= 6.1.14 - Broken Access Control vulnerability

  Medium 4.3

• CVE-2024-5053

  Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.18 - Missing Authorization to Authenticated (Subscriber+) Mailchim

  Medium 4.3