The Fluent Forms plugin for WordPress, used for creating customizable contact forms, surveys, quizzes, and conversational forms, suffers from a stored XSS vulnerability (CWE-79) in versions up to 5.1.19. This vulnerability arises from insufficient input sanitization and output escaping of custom error messages. Authenticated attackers with administrator privileges can inject arbitrary web scripts that execute when the affected page is viewed. The issue is limited to multi-site installations or where unfiltered_html is disabled, reducing the attack surface. No known exploits are reported in the wild, and no official patch or remediation details are provided in the available data.

Successful exploitation allows an authenticated administrator-level user to inject and execute arbitrary scripts in the context of the affected WordPress site. This can lead to limited confidentiality and integrity impacts, such as session hijacking or content manipulation. The vulnerability does not affect availability and requires high privileges and specific installation conditions, which limits its overall risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and consider disabling multi-site features or enabling unfiltered_html if feasible. Monitor vendor channels for updates and apply patches promptly once released.