The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder WordPress plugin is vulnerable to stored cross-site scripting (CWE-79) due to insufficient input sanitization and output escaping of Notification Smartcode values. This vulnerability affects all versions up to and including 6.2.11. An unauthenticated attacker can inject arbitrary scripts that execute in the context of an administrator or any user with Fluent Forms entry-viewing capability when they access the form's submission logs in the WordPress admin dashboard. Successful exploitation depends on the presence of an email notification configured to include attacker-controlled Smartcodes such as input_password fields, cookie values, or submission responses in the subject or static Send To fields.

An attacker can execute arbitrary JavaScript in the browser of privileged users (administrators or users with entry-viewing rights), potentially leading to session hijacking, privilege escalation, or other attacks within the WordPress admin context. The vulnerability does not require authentication to inject the payload but relies on the victim viewing the affected submission logs. The CVSS 3.1 score is 7.2 (High), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impact on confidentiality and integrity with no impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid viewing submission logs that may contain attacker-controlled Smartcodes or disable email notifications referencing untrusted Smartcode values. Monitoring vendor channels for updates and applying patches promptly once released is recommended.