The Fluent Forms plugin for WordPress, used for creating customizable contact forms, surveys, quizzes, and conversational forms, contains a stored XSS vulnerability (CWE-79) identified as CVE-2024-6703. This vulnerability exists in all versions up to and including 5.1.19 due to improper neutralization of input in the 'description' and 'btn_txt' parameters. Attackers with Form Manager permissions and Subscriber+ user roles can inject arbitrary web scripts that execute in the context of users viewing the injected pages. The CVSS 3.1 score is 4.9, reflecting network attack vector, high attack complexity, low privileges required, no user interaction, and partial impact on confidentiality and integrity.

Successful exploitation allows attackers with limited privileges (Form Manager and Subscriber+ roles) to inject persistent malicious scripts into pages generated by the plugin. These scripts execute in the browsers of users who view the affected pages, potentially leading to partial disclosure of information and integrity compromise within the application context. There is no indication of impact on availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Form Manager and Subscriber+ user roles to trusted users only. Monitor plugin updates from techjewel for a security patch addressing this vulnerability. Avoid using affected versions in sensitive environments.