High severity · published Jul 29, 2026
CVE-2026-16655
Fluent Forms <= 6.2.7 - Unauthenticated Stored Cross-Site Scripting via Name Field Nested `password` Member
7.2
CVSS
0.5%
EPSS
No
On KEV
Description
The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Name Field Nested `password` Member in all versions up to, and including, 6.2.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 45% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FF
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder · wpmanageninja
through 6.2.7 · source: vendor
Affected product
FF
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
wpmanageninja
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-16655
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-16655
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/fluentform/tags/6.2.6/app/Hooks/Ajax.php#L17
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/fluentform/tags/6.2.6/app/Modules/Form/FormDataParser.php#L317
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/fluentform/tags/6.2.6/app/Modules/SubmissionHandler/SubmissionHandler.php#L20
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/fluentform/tags/6.2.6/app/Services/Form/SubmissionHandlerService.php#L123
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/fluentform/tags/6.2.6/app/Services/Integrations/GlobalNotificationService.php#L59
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/fluentform/tags/6.2.6/boot/globals.php#L110
More from Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
7.2
CVE-2026-18146
Fluent Forms <= 6.2.11 - Unauthenticated Stored Cross-Site Scripting via Notification Smartcode Values
6.1
CVE-2026-17571
Fluent Forms <= 6.2.8 - Reflected Cross-Site Scripting via 'param'
5.4
CVE-2026-15178
Fluent Forms <= 6.2.5 - Missing Authorization to Authenticated (Custom+) Sensitive Data Exposure and Modification
5.4
CVE-2026-5069
Fluent Forms <= 6.2.1 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Subscription Cancellation via 'subscription_id'
5.3
CVE-2026-17567
Fluent Forms <= 6.2.8 - Unauthenticated Sensitive Information Exposure via Insecure Direct Object Reference and Weak Transaction Hash in 'transaction' Parameter