The Fluent Forms plugin for WordPress, used for creating customizable contact forms, surveys, quizzes, and conversational forms, contains a stored XSS vulnerability (CWE-79) in dropdown fields. Authenticated attackers with administrator privileges can exploit this flaw to inject arbitrary web scripts that execute when users access the affected pages. This issue impacts multi-site installations and installations with unfiltered_html disabled. The vulnerability is present in all versions up to and including 5.1.19. No patch or remediation details have been provided in the available data.

Successful exploitation allows an attacker with administrator-level access to inject persistent malicious scripts into pages generated by the plugin. These scripts execute in the context of users visiting the injected pages, potentially leading to information disclosure or session hijacking. The impact is limited to confidentiality and integrity with no direct availability impact. The vulnerability requires high privileges and does not affect single-site installations or those with unfiltered_html enabled.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator-level access to trusted users only and consider disabling multi-site features or enabling unfiltered_html if feasible. Monitor official vendor channels for updates and apply patches promptly once released.