Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder

Уязвимости

• CVE-2024-2771без авторизации≤ 5.1.16

  Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Missing Authorization to Settings Update and Limited Privilege

  Критич. 9.8

• CVE-2023-24410высокие права≤ 4.3.25

  WordPress FluentForm Plugin <= 4.3.25 is vulnerable to SQL Injection

  Критич. 9.8

• CVE-2026-73532без авторизации

  Fluent Forms Pro 6.2.7 Embedded Malicious Code via Tampered Plugin Build

  Критич. 9.3

• CVE-2021-34620без авторизации · нужен клик→ 3.6.67

  CSRF in WP Fluent Forms < 3.6.67 allows stored XSS and Privilege Escalation

  Высокий 8.8

• CVE-2024-4157участник+≤ 5.1.15

  Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.15 - PHP Object Injection via extractDynamicValues

  Высокий 8.8

• CVE-2026-5395подписчик+≤ 6.2.0

  Fluent Forms <= 6.2.0 - Authenticated (Subscriber+) Authorization Bypass via 'table' Parameter

  Высокий 8.2

• CVE-2026-5396подписчик+≤ 6.1.21

  Fluent Forms <= 6.1.21 - Authenticated (Subscriber+) Authorization Bypass via 'form_id' Parameter

  Высокий 8.2

• CVE-2024-2782без авторизации≤ 5.1.16

  Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Missing Authorization to Setting Manipulation

  Высокий 7.5

• CVE-2026-18146без авторизации≤ 6.2.11

  Fluent Forms <= 6.2.11 - Unauthenticated Stored Cross-Site Scripting via Notification Smartcode Values

  Высокий 7.2

• CVE-2026-16655без авторизации≤ 6.2.7

  Fluent Forms <= 6.2.7 - Unauthenticated Stored Cross-Site Scripting via Name Field Nested `password` Member

  Высокий 7.2

• CVE-2026-2365без авторизации≤ 6.1.17

  Fluent Forms Pro <= 6.1.17 - Unauthenticated Stored Cross-Site Scripting via Draft Form Submission

  Высокий 7.2

• CVE-2026-103343нужен вход≤ 6.2.14

  WordPress FluentForm plugin <= 6.2.14 - Cross Site Scripting (XSS) vulnerability

  Средний 6.5

• CVE-2025-9260подписчик+≤ 6.1.1

  Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder 5.1.16 - 6.1.1 - Authenticated (Subscriber+) PHP Object Injection To Arbi

  Средний 6.5

• CVE-2026-0996подписчик+≤ 6.1.14

  Fluent Forms <= 6.1.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via AI Form Builder Module

  Средний 6.4

• CVE-2026-6828участник+≤ 6.2.1

  Fluent Forms <= 6.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'permission_message' Shortcode Attribute

  Средний 6.4

• CVE-2025-3615участник+≤ 6.0.2

  Fluent Forms <= 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

  Средний 6.4

• CVE-2024-4709участник+≤ 5.1.16

  Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Authenticated (Contributor+) Stored Cross-Site Scripting

  Средний 6.4

• CVE-2026-17571без авторизации · нужен клик≤ 6.2.8

  Fluent Forms <= 6.2.8 - Reflected Cross-Site Scripting via 'param'

  Средний 6.1

• CVE-2024-10646без авторизации≤ 5.2.6

  Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.2.6 - Unauthenticated Stored Cross-Site Scripting via Form Subject

  Средний 6.1

• CVE-2026-5069подписчик+≤ 6.2.1

  Fluent Forms <= 6.2.1 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Subscription Cancellation via 'subscription_id'

  Средний 5.4

• CVE-2024-6703подписчик+≤ 5.1.19

  Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Subscriber+) Stored Cross-Site Scripting via We

  Средний 5.4

• CVE-2023-6957участник+≤ 5.1.9

  Fluent Forms <= 5.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

  Средний 5.4

• CVE-2026-103353без авторизации≤ 6.2.14

  WordPress FluentForm plugin <= 6.2.14 - Broken Access Control vulnerability

  Средний 5.3

• CVE-2026-17567без авторизации≤ 6.2.8

  Fluent Forms <= 6.2.8 - Unauthenticated Sensitive Information Exposure via Insecure Direct Object Reference and Weak Transaction Hash in 'transaction' Parameter

  Средний 5.3

• CVE-2026-4160без авторизации

  Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.1.21 - Insecure Direct Object Reference in Stripe SCA Confirmation t

  Средний 5.3

• CVE-2025-69001без авторизации≤ 6.1.11

  WordPress FluentForm plugin <= 6.1.11 - Arbitrary Shortcode Execution vulnerability

  Средний 5.3

• CVE-2025-13748без авторизации≤ 6.1.7

  Fluent Forms <= 6.1.7 - Unauthenticated Insecure Direct Object Reference to Payment Status Tampering via submission_id

  Средний 5.3

• CVE-2024-13666без авторизации≤ 5.2.12

  Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 5.2.12 - IP-Spoofing

  Средний 5.3

• CVE-2023-41952без авторизации≤ 5.0.8

  WordPress Fluent Forms plugin <= 5.0.8 - Broken Access Control vulnerability

  Средний 5.3

• CVE-2025-13722подписчик+≤ 6.1.7

  Fluent Forms <= 6.1.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Form Creation via AI Builder

  Средний 5.3

• CVE-2026-6344админ≤ 6.2.1

  Fluent Forms <= 6.2.1 - Authenticated (Administrator+) Arbitrary File Read via Path Traversal in Email Attachment

  Средний 4.9

• CVE-2024-9528нужен вход≤ 5.1.19

  Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Form Manager+) Stored Cross-Site Scripting

  Средний 4.8

• CVE-2024-0618админ≤ 5.1.5

  Fluent Forms <= 5.1.5 - Authenticated(Administrator+) Stored Cross-Site Scripting via imported form title

  Средний 4.8

• CVE-2024-6521админ≤ 5.1.19

  Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Administrator+) Stored Cross-Site Scripting

  Средний 4.4

• CVE-2024-6520админ≤ 5.1.19

  Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Administrator+) Stored Cross-Site Scripting

  Средний 4.4

• CVE-2024-6518админ≤ 5.1.19

  Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Administrator+) Stored Cross-Site Scripting

  Средний 4.4

• CVE-2026-25313нужен вход≤ 6.1.14

  WordPress FluentForm plugin <= 6.1.14 - Broken Access Control vulnerability

  Средний 4.3

• CVE-2024-5053подписчик+≤ 5.1.18

  Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.18 - Missing Authorization to Authenticated (Subscriber+) Mailchim

  Средний 4.3