WordPress plugin
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 47 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical1
- High10
- Medium36
- Low0
All Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder vulnerabilities
- Medium5.3Missing Authorization
≤6.2.16Update to 6.2.17
- Medium5.3Missing Authorization
≤6.2.15Update to 6.2.16
- Medium5.4Missing Authorization to Authenticated (Custom+) Sensitive Data Exposure and Modification
≤6.2.5Update to 6.2.6
- Medium4.7Reflected Cross-Site Scripting via '{get.*}' Editor SmartCode Parameter
≤6.2.14Update to 6.2.15
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤6.2.14Update to 6.2.15
- Medium5.3Missing Authorization
≤6.2.14Update to 6.2.15
- High7.2Unauthenticated Stored Cross-Site Scripting via Notification Smartcode Values
≤6.2.11Update to 6.2.12
- Medium4.3Insecure Direct Object Reference to Authenticated (Form Manager+) Cross-Form Submission Entry Deletion
≤6.2.4Update to 6.2.5
- Medium4.3Insecure Direct Object Reference to Authenticated (Subscriber+) Subscription Cancellation
≤6.2.0Update to 6.2.1
- Medium6.1Reflected Cross-Site Scripting via 'param'
≤6.2.8Update to 6.2.9
- Medium5.3Unauthenticated Sensitive Information Exposure via Insecure Direct Object Reference and Weak Transaction Hash in 'transaction' Parameter
≤6.2.8Update to 6.2.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
<6.2.6Update to 6.2.6
- High7.2Unauthenticated Stored Cross-Site Scripting via Name Field Nested `password` Member
≤6.2.7Update to 6.2.8
- Medium5.4Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Subscription Cancellation via 'subscription_id'
≤6.2.1Update to 6.2.2
- High8.2Authenticated (Subscriber+) Authorization Bypass via 'table' Parameter
≤6.2.0Update to 6.2.1
- High8.2Authenticated (Subscriber+) Authorization Bypass via 'form_id' Parameter
≤6.1.21Update to 6.2.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'permission_message' Shortcode Attribute
≤6.2.1Update to 6.2.2
- Medium4.9Authenticated (Administrator+) Arbitrary File Read via Path Traversal in Email Attachment
≤6.2.1Update to 6.2.2
- Medium5.3Insecure Direct Object Reference in Stripe SCA Confirmation to Unauthenticated Payment Status Modification
6.1.21 – 6.1.21Update to 6.2.0
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via AI Form Builder Module
≤6.1.14Update to 6.1.15
- Medium4.3Missing Authorization
≤6.1.14Update to 6.1.15
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
≤6.1.11Update to 6.1.12
- Medium5.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Form Creation via AI Builder
≤6.1.7Update to 6.1.8
- Medium5.3Unauthenticated Insecure Direct Object Reference to Payment Status Tampering via submission_id
≤6.1.7Update to 6.1.8
- Medium6.56.1.1 - Authenticated (Subscriber+) PHP Object Injection To Arbitrary File Read
5.1.16 – 6.1.1Update to 6.1.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤6.0.2Update to 6.0.3
- Medium5.3IP-Spoofing
≤5.2.12Update to 6.0.0
- High7.2Unauthenticated Stored Cross-Site Scripting via Form Subject
≤5.2.6Update to 5.2.7
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤5.2.0Update to 5.2.1
- Medium4.9Authenticated (Form Manager+) Stored Cross-Site Scripting
≤5.1.19Update to 5.1.20
- Medium4.2Missing Authorization to Authenticated (Subscriber+) Mailchimp Integration Modification
≤5.1.18Update to 5.1.19
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤5.1.19Update to 5.1.20
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤5.1.19Update to 5.1.20
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤5.1.19Update to 5.1.20
- Medium4.9Authenticated (Subscriber+) Stored Cross-Site Scripting via Welcome Screen Fields
≤5.1.19Update to 5.1.20
- High7.5PHP Object Injection via extractDynamicValues
≤5.1.15Update to 5.1.16
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
≤5.1.13Update to 5.1.14
- High7.5Missing Authorization to Setting Manipulation
≤5.1.16Update to 5.1.17
- Critical9.8Missing Authorization to Settings Update and Limited Privilege Escalation
≤5.1.16Update to 5.1.17
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤5.1.16Update to 5.1.17
- Medium4.9Authenticated (Contributor+) Stored Cross-Site Scripting
≤5.1.9Update to 5.1.10
- Medium4.4Authenticated(Administrator+) Stored Cross-Site Scripting via imported form title
≤5.1.5Update to 5.1.7
- Medium5.3Insecure Direct Object Reference
<5.0.9Update to 5.0.9
- High7.2Authenticated (Administrator+) SQL Injection
≤4.3.25Update to 5.0.0
- Medium6.4Authenticated(Contributor+) Stored Cross-Site Scripting
≤4.3.24Update to 4.3.25
- High8.3CSV Injection
≤4.3.12Update to 4.3.13
- High8.8Stored Cross-Site Scripting
<3.6.67Update to 3.6.67
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder: common questions
Does Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder have known vulnerabilities?
Yes. VulnCrest Radar lists 47 known vulnerabilities in Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder: 1 critical, 10 high, 36 medium. None are known to affect version null.
How do I check which version of Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder vulnerability?
CVE-2026-120858, published Nov 6, 2026: Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.2.16 - Missing Authorization. Severity: Medium (CVSS 5.3).
Is any Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder vulnerability listed in CISA KEV?
No. None of the known Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder vulnerabilities is currently listed in the CISA KEV catalog.