Fluent Forms - Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder vulnerabilities

Known security issues in the Fluent Forms - Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder WordPress plugin, by affected version, with severity, CVE and the version that fixes each one.

Plugin slug: fluentform
Latest version: 6.2.16
Active installs: 800,000+
Known vulnerabilities: 46
Data updated: 2026-10-18 08:09 UTC

View on wordpress.org

Check your version

This information comes from public vulnerability databases and may be incomplete or out of date. A plugin with no known vulnerabilities is not proof that it is secure; keep plugins updated and remove the ones you do not use.

Fixed in version 6.2.15 (3)

Fluent Forms - Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder: Fixed in version 6.2.15
Vulnerability	Severity	CVSS	Affected versions	Published
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.2.14 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2026-103343 · Source	Medium	6.5	< 6.2.15	2026-10-01
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.2.14 - Missing Authorization CVE-2026-103353 · Source	Medium	5.3	< 6.2.15	2026-10-01
*Fluent Forms <= 6.2.14 - Reflected Cross-Site Scripting via '{get.}' Editor SmartCode Parameter** CVE-2026-101324 · Source	Medium	4.7	< 6.2.15	2026-10-09

Fixed in version 6.2.12 (1)

Fluent Forms - Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder: Fixed in version 6.2.12
Vulnerability	Severity	CVSS	Affected versions	Published
Fluent Forms <= 6.2.11 - Unauthenticated Stored Cross-Site Scripting via Notification Smartcode Values CVE-2026-18146 · Source	High	7.2	< 6.2.12	2026-07-31

Fixed in version 6.2.9 (2)

Fluent Forms - Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder: Fixed in version 6.2.9
Vulnerability	Severity	CVSS	Affected versions	Published
Fluent Forms <= 6.2.8 - Reflected Cross-Site Scripting via 'param' CVE-2026-17571 · Source	Medium	6.1	< 6.2.9	2026-07-31
Fluent Forms <= 6.2.8 - Unauthenticated Sensitive Information Exposure via Insecure Direct Object Reference and Weak Transaction Hash in 'transaction' Parameter CVE-2026-17567 · Source	Medium	5.3	< 6.2.9	2026-07-30

Fixed in version 6.2.8 (1)

Fluent Forms - Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder: Fixed in version 6.2.8
Vulnerability	Severity	CVSS	Affected versions	Published
Fluent Forms <= 6.2.7 - Unauthenticated Stored Cross-Site Scripting via Name Field Nested `password` Member CVE-2026-16655 · Source	High	7.2	< 6.2.8	2026-07-28

Fixed in version 6.2.6 (2)

Fluent Forms - Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder: Fixed in version 6.2.6
Vulnerability	Severity	CVSS	Affected versions	Published
Fluent Forms <= 6.2.5 - Missing Authorization to Authenticated (Custom+) Sensitive Data Exposure and Modification CVE-2026-15178 · Source	Medium	5.4	< 6.2.6	2026-10-09
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder < 6.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2026-11881 · Source	Not rated	-	< 6.2.6	2026-07-30

Fixed in version 6.2.5 (1)

Fluent Forms - Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder: Fixed in version 6.2.5
Vulnerability	Severity	CVSS	Affected versions	Published
Fluent Forms <= 6.2.4 - Insecure Direct Object Reference to Authenticated (Form Manager+) Cross-Form Submission Entry Deletion CVE-2026-11578 · Source	Not rated	-	< 6.2.5	2026-07-02

Fixed in version 6.2.2 (3)

Fluent Forms - Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder: Fixed in version 6.2.2
Vulnerability	Severity	CVSS	Affected versions	Published
Fluent Forms <= 6.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'permission_message' Shortcode Attribute CVE-2026-6828 · Source	Medium	6.4	< 6.2.2	2026-05-12
Fluent Forms <= 6.2.1 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Subscription Cancellation via 'subscription_id' CVE-2026-5069 · Source	Medium	5.4	< 6.2.2	2026-07-09
Fluent Forms <= 6.2.1 - Authenticated (Administrator+) Arbitrary File Read via Path Traversal in Email Attachment CVE-2026-6344 · Source	Medium	4.9	< 6.2.2	2026-05-05

Fixed in version 6.2.1 (2)

Fluent Forms - Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder: Fixed in version 6.2.1
Vulnerability	Severity	CVSS	Affected versions	Published
Fluent Forms <= 6.2.0 - Authenticated (Subscriber+) Authorization Bypass via 'table' Parameter CVE-2026-5395 · Source	High	8.2	< 6.2.1	2026-05-13
Fluent Forms <= 6.2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Subscription Cancellation CVE-2026-11880 · Source	Not rated	-	< 6.2.1	2026-07-01

Fixed in version 6.2.0 (2)

Fluent Forms - Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder: Fixed in version 6.2.0
Vulnerability	Severity	CVSS	Affected versions	Published
Fluent Forms <= 6.1.21 - Authenticated (Subscriber+) Authorization Bypass via 'form_id' Parameter CVE-2026-5396 · Source	High	8.2	< 6.2.0	2026-05-13
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.1.21 - Insecure Direct Object Reference in Stripe SCA Confirmation to Unauthenticated Payment Status Modification CVE-2026-4160 · Source	Medium	5.3	< 6.2.0	2026-04-16

Fixed in version 6.1.15 (2)

Fluent Forms - Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder: Fixed in version 6.1.15
Vulnerability	Severity	CVSS	Affected versions	Published
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.1.14 - Missing Authorization CVE-2026-25313 · Source	Medium	4.3	< 6.1.15	2026-01-25
Fluent Forms <= 6.1.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via AI Form Builder Module CVE-2026-0996 · Source	Not rated	-	< 6.1.15	0000-00-00

Fixed in version 6.1.12 (1)

Fluent Forms - Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder: Fixed in version 6.1.12
Vulnerability	Severity	CVSS	Affected versions	Published
FluentForm <= 6.1.11 - Unauthenticated Arbitrary Shortcode Execution CVE-2025-69001 · Source	Medium	5.3	< 6.1.12	2026-01-13

Fixed in version 6.1.8 (2)

Fluent Forms - Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder: Fixed in version 6.1.8
Vulnerability	Severity	CVSS	Affected versions	Published
Fluent Forms <= 6.1.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Form Creation via AI Builder CVE-2025-13722 · Source	Medium	5.3	< 6.1.8	2026-01-06
Fluent Forms <= 6.1.7 - Unauthenticated Insecure Direct Object Reference to Payment Status Tampering via submission_id CVE-2025-13748 · Source	Medium	5.3	< 6.1.8	2025-12-05

Fixed in version 6.1.2 (1)

Fluent Forms - Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder: Fixed in version 6.1.2
Vulnerability	Severity	CVSS	Affected versions	Published
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder 5.1.16 - 6.1.1 - Authenticated (Subscriber+) PHP Object Injection To Arbitrary File Read CVE-2025-9260 · Source	Not rated	-	< 6.1.2	0000-00-00

Fixed in version 6.0.3 (1)

Fluent Forms - Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder: Fixed in version 6.0.3
Vulnerability	Severity	CVSS	Affected versions	Published
Fluent Forms <= 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2025-3615 · Source	Medium	6.4	< 6.0.3	0000-00-00

Fixed in version 6.0.0 (1)

Fluent Forms - Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder: Fixed in version 6.0.0
Vulnerability	Severity	CVSS	Affected versions	Published
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 5.2.12 - IP-Spoofing CVE-2024-13666 · Source	Medium	5.3	< 6.0.0	2025-03-21

Fixed in version 5.2.7 (1)

Fluent Forms - Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder: Fixed in version 5.2.7
Vulnerability	Severity	CVSS	Affected versions	Published
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.2.6 - Unauthenticated Stored Cross-Site Scripting via Form Subject CVE-2024-10646 · Source	High	7.2	< 5.2.7	2024-12-13

Fixed in version 5.2.1 (1)

Fluent Forms - Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder: Fixed in version 5.2.1
Vulnerability	Severity	CVSS	Affected versions	Published
Fluent Forms <= 5.2.0 - Authenticated (Admin+) Stored Cross-Site Scripting CVE-2024-9651 · Source	Medium	6.1	< 5.2.1	2024-11-18

Fixed in version 5.1.20 (5)

Fluent Forms - Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder: Fixed in version 5.1.20
Vulnerability	Severity	CVSS	Affected versions	Published
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Welcome Screen Fields CVE-2024-6703 · Source	Medium	5.4	< 5.1.20	2024-07-26
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Form Manager+) Stored Cross-Site Scripting CVE-2024-9528 · Source	Medium	4.8	< 5.1.20	2024-10-04
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2024-6520 · Source	Medium	4.8	< 5.1.20	2024-07-26
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2024-6518 · Source	Medium	4.8	< 5.1.20	2024-07-26
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2024-6521 · Source	Medium	4.8	< 5.1.20	2024-07-26

Fixed in version 5.1.19 (1)

Fluent Forms - Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder: Fixed in version 5.1.19
Vulnerability	Severity	CVSS	Affected versions	Published
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.18 - Missing Authorization to Authenticated (Subscriber+) Mailchimp Integration Modification CVE-2024-5053 · Source	Medium	4.3	< 5.1.19	2024-08-31

Fixed in version 5.1.17 (3)

Fluent Forms - Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder: Fixed in version 5.1.17
Vulnerability	Severity	CVSS	Affected versions	Published
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Missing Authorization to Settings Update and Limited Privilege Escalation CVE-2024-2771 · Source	Critical	9.8	< 5.1.17	2024-05-17
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Missing Authorization to Setting Manipulation CVE-2024-2782 · Source	High	7.5	< 5.1.17	2024-05-17
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-4709 · Source	Medium	5.4	< 5.1.17	2024-05-17

Fixed in version 5.1.16 (1)

Fluent Forms - Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder: Fixed in version 5.1.16
Vulnerability	Severity	CVSS	Affected versions	Published
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.15 - PHP Object Injection via extractDynamicValues CVE-2024-4157 · Source	High	8.8	< 5.1.16	2024-05-21

Fixed in version 5.1.14 (1)

Fluent Forms - Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder: Fixed in version 5.1.14
Vulnerability	Severity	CVSS	Affected versions	Published
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting CVE-2024-2772 · Source	Medium	5.4	< 5.1.14	2024-05-17

Fixed in version 5.1.10 (1)

Fluent Forms - Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder: Fixed in version 5.1.10
Vulnerability	Severity	CVSS	Affected versions	Published
Fluent Forms <= 5.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2023-6957 · Source	Medium	5.4	< 5.1.10	2024-03-05

Fixed in version 5.1.7 (2)

Fluent Forms - Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder: Fixed in version 5.1.7
Vulnerability	Severity	CVSS	Affected versions	Published
Fluent Forms <= 5.1.5 - Authenticated(Administrator+) Stored Cross-Site Scripting via imported form title CVE-2024-0618 · Source	Medium	4.8	< 5.1.7	2024-01-18
WordPress FluentForm Plugin <= 5.1.5 is vulnerable to Cross Site Scripting (XSS) No CVE assigned · Source	Not rated	-	< 5.1.7	2024-01-19

Fixed in version 5.0.9 (1)

Fluent Forms - Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder: Fixed in version 5.0.9
Vulnerability	Severity	CVSS	Affected versions	Published
Contact Form for Plugin by Fluent Forms <= 5.0.8 - Insecure Direct Object Reference CVE-2023-41952 · Source	Medium	5.3	< 5.0.9	2023-09-08

Fixed in version 5.0.0 (1)

Fluent Forms - Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder: Fixed in version 5.0.0
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress FluentForm Plugin <= 4.3.25 is vulnerable to SQL Injection CVE-2023-24410 · Source	Medium	5.5	< 5.0.0	2023-07-12

Fixed in version 4.3.25 (1)

Fluent Forms - Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder: Fixed in version 4.3.25
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress FluentForm Plugin < 4.3.25 is vulnerable to Cross Site Scripting (XSS) CVE-2023-0546 · Source	Medium	5.4	< 4.3.25	2023-03-20

Fixed in version 4.3.13 (1)

Fluent Forms - Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder: Fixed in version 4.3.13
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress FluentForm plugin <= 4.3.12 - CSV Injection vulnerability CVE-2022-3463 · Source	Critical	9.8	< 4.3.13	2022-10-17

Fixed in version 3.6.67 (1)

Fluent Forms - Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder: Fixed in version 3.6.67
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Contact Form Plugin by Fluent Forms <= 3.6.65 - Cross-Site Request Forgery (CSRF) vulnerability leading to stored Cross-Site Scripting (XSS) CVE-2021-34620 · Source	High	8.8	< 3.6.67	2021-06-16

Check every plugin on your site automatically

Install the free Webforta Security plugin for WordPress and Webforta matches every plugin, theme and WordPress version you run against known vulnerabilities, and tells you when a new one affects your site.

Start free About the WordPress plugin

Sources and attribution

Vulnerability data from WPVulnerability (WordPress, plugins, themes and server software). WPVulnerability data license.
CVE records are copyright The MITRE Corporation. CVE Terms of Use.
Known-exploited status from the CISA Known Exploited Vulnerabilities catalog. Public domain (U.S. Government work).
Plugin names, latest versions and install counts from the WordPress.org plugin directory. WordPress is a trademark of the WordPress Foundation; Webforta is not affiliated with or endorsed by WordPress.org, WPVulnerability or the sources above.