The Fluent Forms Pro plugin for WordPress contains a stored XSS vulnerability via the `fluentform_step_form_save_data` AJAX action. The root cause is the publicly accessible draft form submission endpoint lacking authentication and nonce verification, combined with insufficient input sanitization and output escaping of form field data. This enables unauthenticated attackers to inject arbitrary scripts that execute in the context of administrator users viewing partial form entries. The vulnerability affects all versions up to 6.1.17 and is tracked as CVE-2026-2365 with a CVSS 3.1 score of 7.2 (High).

An unauthenticated attacker can exploit this vulnerability to inject and store malicious scripts that execute in the browser of an administrator viewing the affected form entries. This can lead to limited confidentiality and integrity impacts, such as session hijacking or unauthorized actions performed with administrator privileges. Availability is not impacted. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the WordPress admin interface to trusted users only and consider disabling or limiting use of the affected AJAX endpoint if possible. Monitor vendor channels for updates and apply patches promptly once released.