CVE-2026-16655 is a stored cross-site scripting vulnerability in the Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder WordPress plugin by wpmanageninja. The issue exists in all versions up to and including 6.2.7 and is due to improper neutralization of input during web page generation, specifically via the Name Field Nested `password` member. This allows unauthenticated attackers to inject arbitrary web scripts that execute in the context of users viewing the injected pages. The CVSS v3.1 base score is 7.2, indicating a high severity vulnerability with network attack vector, low attack complexity, no privileges required, no user interaction needed, and impacts confidentiality and integrity but not availability.

Successful exploitation enables unauthenticated attackers to perform stored cross-site scripting attacks, leading to arbitrary script execution in users' browsers when they access the injected content. This can result in information disclosure and integrity impacts such as session hijacking or unauthorized actions performed on behalf of users. There is no indication of availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor wpmanageninja's advisories for updates. Until a patch is available, consider disabling or restricting access to the vulnerable plugin functionality to prevent exploitation.