The Fluent Forms plugin for WordPress, used for creating customizable contact forms, surveys, quizzes, and conversational forms, contains a stored XSS vulnerability (CWE-79) in form label fields. Authenticated users with permission to edit forms can inject arbitrary JavaScript code due to improper input sanitization and output escaping. This malicious code executes in the context of users viewing the injected pages, potentially leading to session hijacking or other script-based attacks. The vulnerability affects all versions up to and including 5.1.19. The CVSS 3.1 base score is 4.9, reflecting network attack vector, high attack complexity, low privileges required, no user interaction, and impact on confidentiality and integrity but not availability.

An authenticated user with form editing rights can inject persistent malicious scripts into form labels. These scripts execute in the browsers of users who view the affected forms, potentially compromising user data confidentiality and integrity. The vulnerability does not impact availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict form editing permissions strictly to trusted administrators. Monitor for updates from the vendor and apply patches promptly once available. Avoid exposing form editing capabilities to untrusted users.