The Fluent Forms WordPress plugin versions prior to 6.2.6 contain a stored XSS vulnerability (CWE-79) due to improper sanitization and escaping of a form field configuration setting. This setting is output inside an inline script when a form is rendered, enabling users with Contributor-level roles and delegated form-management permissions to inject malicious scripts. These scripts execute in the context of any user viewing the form, including administrators, potentially leading to credential theft or session hijacking. The vulnerability has a CVSS 3.1 base score of 6.1, indicating medium severity. No official patch or remediation guidance is currently provided in the available data.

Successful exploitation allows stored Cross-Site Scripting attacks that execute arbitrary JavaScript in the browsers of users who load the affected form, including administrators previewing the form. This can lead to information disclosure or session hijacking. The vulnerability can be exploited by users with Contributor roles who have delegated form-management permissions but lack unfiltered_html capability, which is notable in multisite WordPress setups.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict form-management permissions to trusted users only and avoid granting delegated form-management permissions to Contributor roles. Monitor vendor channels for updates and apply patches promptly once released.