The Fluent Forms plugin for WordPress contains a stored XSS vulnerability in its AI Form Builder module due to missing authorization checks, a leaked nonce, and inadequate input sanitization. Subscriber-level users can trigger AI form generation via a protected endpoint, causing AI services to return raw JavaScript code without <script> tags. This code bypasses the plugin's sanitization and is stored, executing whenever the generated form is viewed by any user. This allows injection of arbitrary scripts in the context of users accessing the form, potentially leading to session hijacking or other client-side attacks.

An attacker with Subscriber-level access can inject and store malicious JavaScript code that executes in the browsers of users who view the generated forms. This can lead to unauthorized actions performed on behalf of users, data theft, or other client-side impacts. The vulnerability does not affect availability and requires authenticated access, but it compromises confidentiality and integrity of user sessions or data within the affected WordPress site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level user permissions to trusted users only and avoid using the AI Form Builder module if possible. Monitor vendor channels for updates and apply patches promptly once released.