The Fluent Forms WordPress plugin versions prior to 6.2.6 contain a stored XSS vulnerability (CWE-79) due to improper sanitization and escaping of a form field configuration setting. This setting is output inside an inline script tag when rendering a form. Users with Contributor role and delegated form-management permissions can exploit this to inject malicious JavaScript that executes in the context of any user viewing the form, potentially including administrators. The vulnerability is documented as CVE-2026-11881 and was published on 2026-07-30. No CVSS score or official remediation level is provided, and no patch links are currently available.

This vulnerability enables stored Cross-Site Scripting attacks that can execute arbitrary JavaScript in the browsers of users who load the vulnerable form. This includes site administrators previewing the form, which could lead to session hijacking, privilege escalation, or other malicious actions within the context of the affected WordPress site. The attack requires the attacker to have at least Contributor role with delegated form-management permissions but no unfiltered_html capability, which is a relatively low privilege level in multisite setups.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor for updates from the Fluent Forms plugin vendor and apply any official patches once available. Until then, restrict Contributor role permissions related to form management or avoid using the affected plugin versions. Avoid granting delegated form-management permissions to untrusted users.