The Fluent Forms plugin for WordPress, versions up to 5.1.5, contains a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Specifically, imported form titles are not sufficiently sanitized or escaped, allowing authenticated administrators to inject arbitrary scripts. This vulnerability only impacts multi-site WordPress installations or those with unfiltered_html disabled, enabling script execution in pages viewed by users. The CVSS 3.1 base score is 4.4 (medium), with network attack vector, high attack complexity, and requiring administrator privileges. No patch or official remediation guidance has been provided by the vendor as of the publication date.

An authenticated attacker with administrator-level access can exploit this vulnerability to inject and execute arbitrary JavaScript in the context of affected pages. This could lead to session hijacking, defacement, or other client-side attacks against users viewing the injected pages. The impact is limited to multi-site or restricted HTML capability environments and requires high privileges, reducing the overall risk. There is no indication of availability impact or known active exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator access to trusted users only and consider disabling multi-site features or enabling unfiltered_html if feasible. Monitor official channels for updates from the Fluent Forms plugin vendor regarding patches or workarounds.