Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder vulnerabilities

Product

Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder

by techjewel · last CVE May 14, 2026

CVEs

On KEV

9.8

Max CVSS

New 30D

Vulnerabilities25 In the news0 Timeline

Severity mix

Critical 1High 4Medium 20Low 0

Severity

All severities25 Critical1 High4 Medium20 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2024-2771	9.8	2%	May 18	Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Missing Authorization to Settings Update and Limited Privilege Escalation Affected: through 5.1.16
CVE-2024-4157	8.8	1%	May 22	Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.15 - PHP Object Injection via extractDynamicValues Affected: through 5.1.15
CVE-2026-5395	8.2	0%	May 14	Fluent Forms <= 6.2.0 - Authenticated (Subscriber+) Authorization Bypass via 'table' Parameter Affected: through 6.2.0
CVE-2026-5396	8.2	0%	May 14	Fluent Forms <= 6.1.21 - Authenticated (Subscriber+) Authorization Bypass via 'form_id' Parameter Affected: through 6.1.21
CVE-2024-2782	7.5	1%	May 18	Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Missing Authorization to Setting Manipulation Affected: through 5.1.16
CVE-2025-9260	6.5	1%	Sep 2	Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder 5.1.16 - 6.1.1 - Authenticated (Subscriber+) PHP Object Injection To Arbitrary File Read Affected: 5.1.16 through 6.1.1
CVE-2026-6828	6.4	0%	May 13	Fluent Forms <= 6.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'permission_message' Shortcode Attribute Affected: through 6.2.1
CVE-2026-0996	6.4	0%	Feb 10	Fluent Forms <= 6.1.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via AI Form Builder Module Affected: through 6.1.14
CVE-2025-3615	6.4	0%	Apr 17	Fluent Forms <= 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting Affected: through 6.0.2
CVE-2024-4709	6.4	0%	May 18	Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Authenticated (Contributor+) Stored Cross-Site Scripting Affected: through 5.1.16
CVE-2024-10646	6.1	0%	Dec 14	Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.2.6 - Unauthenticated Stored Cross-Site Scripting via Form Subject Affected: through 5.2.6
CVE-2024-6703	5.4	0%	Jul 27	Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Welcome Screen Fields Affected: through 5.1.19
CVE-2024-2772	5.4	0%	May 18	Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting Affected: through 5.1.13
CVE-2023-6957	5.4	0%	Mar 13	Fluent Forms <= 5.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting Affected: through 5.1.9
CVE-2026-4160	5.3	0%	Apr 16	Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.1.21 - Insecure Direct Object Reference in Stripe SCA Confirmation to Unauthenticated Payment Status Modification Affected: 6.1.21
CVE-2025-13722	5.3	0%	Jan 7	Fluent Forms <= 6.1.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Form Creation via AI Builder Affected: through 6.1.7
CVE-2025-13748	5.3	0%	Dec 6	Fluent Forms <= 6.1.7 - Unauthenticated Insecure Direct Object Reference to Payment Status Tampering via submission_id Affected: through 6.1.7
CVE-2024-13666	5.3	0%	Mar 22	Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 5.2.12 - IP-Spoofing Affected: through 5.2.12
CVE-2026-6344	4.9	1%	May 6	Fluent Forms <= 6.2.1 - Authenticated (Administrator+) Arbitrary File Read via Path Traversal in Email Attachment Affected: through 6.2.1
CVE-2024-9528	4.8	0%	Oct 5	Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Form Manager+) Stored Cross-Site Scripting Affected: through 5.1.19
CVE-2024-0618	4.8	1%	Jan 27	Fluent Forms <= 5.1.5 - Authenticated(Administrator+) Stored Cross-Site Scripting via imported form title Affected: through 5.1.5
CVE-2024-6518	4.4	0%	Jul 27	Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Administrator+) Stored Cross-Site Scripting Affected: through 5.1.19
CVE-2024-6520	4.4	0%	Jul 27	Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Administrator+) Stored Cross-Site Scripting Affected: through 5.1.19
CVE-2024-6521	4.4	0%	Jul 27	Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Administrator+) Stored Cross-Site Scripting Affected: through 5.1.19
CVE-2024-5053	4.3	0%	Sep 1	Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.18 - Missing Authorization to Authenticated (Subscriber+) Mailchimp Integration Modification Affected: through 5.1.18