CVE-2026-17571 describes a reflected cross-site scripting vulnerability in the Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress. The issue exists in all versions up to and including 6.2.8 due to improper neutralization of input during web page generation, specifically via the 'param' parameter. This allows unauthenticated attackers to inject malicious scripts that execute in the context of a victim's browser if they can trick the user into clicking a crafted link. The vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 6.1, indicating medium severity. No official patch or remediation level is provided in the available data.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to information disclosure or manipulation of the user interface. The vulnerability requires user interaction (clicking a crafted link) and does not require privileges or authentication. There is no indication of impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid clicking untrusted links that may exploit this vulnerability. Monitor the vendor's communications for updates on patches or official mitigations.