Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder vulnerabilities

Product

Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder

by wpmanageninja · last CVE Oct 10, 2026

CVEs

On KEV

7.2

Max CVSS

New 30D

Vulnerabilities7 In the news0 Timeline

Severity mix

Critical 0High 2Medium 5Low 0

Severity

All severities7 Critical0 High2 Medium5 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-18146	7.2	0%	Aug 13	Fluent Forms <= 6.2.11 - Unauthenticated Stored Cross-Site Scripting via Notification Smartcode Values Affected: through 6.2.11
CVE-2026-16655	7.2	1%	Jul 29	Fluent Forms <= 6.2.7 - Unauthenticated Stored Cross-Site Scripting via Name Field Nested `password` Member Affected: through 6.2.7
CVE-2026-17571	6.1	0%	Aug 1	Fluent Forms <= 6.2.8 - Reflected Cross-Site Scripting via 'param' Affected: through 6.2.8
CVE-2026-15178	5.4	0%	Oct 10	Fluent Forms <= 6.2.5 - Missing Authorization to Authenticated (Custom+) Sensitive Data Exposure and Modification Affected: through 6.2.5
CVE-2026-5069	5.4	0%	Jul 10	Fluent Forms <= 6.2.1 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Subscription Cancellation via 'subscription_id' Affected: through 6.2.1
CVE-2026-17567	5.3	1%	Jul 31	Fluent Forms <= 6.2.8 - Unauthenticated Sensitive Information Exposure via Insecure Direct Object Reference and Weak Transaction Hash in 'transaction' Parameter Affected: through 6.2.8
CVE-2026-101324	4.7	0%	Oct 10	Fluent Forms <= 6.2.14 - Reflected Cross-Site Scripting via '{get.*}' Editor SmartCode Parameter Affected: through 6.2.14