WordPress plugin
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 47 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical1
- High10
- Medium36
- Low0
All Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High7.2 | Unauthenticated Stored Cross-Site Scripting via Notification Smartcode Values ≤6.2.11Update to 6.2.12 | CVE-2026-18146 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting via Name Field Nested `password` Member ≤6.2.7Update to 6.2.8 | CVE-2026-16655 | |
| High8.2 | Authenticated (Subscriber+) Authorization Bypass via 'table' Parameter ≤6.2.0Update to 6.2.1 | CVE-2026-5395 | |
| High8.2 | Authenticated (Subscriber+) Authorization Bypass via 'form_id' Parameter ≤6.1.21Update to 6.2.0 | CVE-2026-5396 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting via Form Subject ≤5.2.6Update to 5.2.7 | CVE-2024-10646 | |
| High7.5 | PHP Object Injection via extractDynamicValues ≤5.1.15Update to 5.1.16 | CVE-2024-4157 | |
| High7.5 | Missing Authorization to Setting Manipulation ≤5.1.16Update to 5.1.17 | CVE-2024-2782 | |
| Critical9.8 | Missing Authorization to Settings Update and Limited Privilege Escalation ≤5.1.16Update to 5.1.17 | CVE-2024-2771 | |
| High7.2 | Authenticated (Administrator+) SQL Injection ≤4.3.25Update to 5.0.0 | CVE-2023-24410 | |
| High8.3 | CSV Injection ≤4.3.12Update to 4.3.13 | CVE-2022-3463 | |
| High8.8 | Stored Cross-Site Scripting <3.6.67Update to 3.6.67 | CVE-2021-34620 |
- High7.2Unauthenticated Stored Cross-Site Scripting via Notification Smartcode Values
≤6.2.11Update to 6.2.12
- High7.2Unauthenticated Stored Cross-Site Scripting via Name Field Nested `password` Member
≤6.2.7Update to 6.2.8
- High8.2Authenticated (Subscriber+) Authorization Bypass via 'table' Parameter
≤6.2.0Update to 6.2.1
- High8.2Authenticated (Subscriber+) Authorization Bypass via 'form_id' Parameter
≤6.1.21Update to 6.2.0
- High7.2Unauthenticated Stored Cross-Site Scripting via Form Subject
≤5.2.6Update to 5.2.7
- High7.5PHP Object Injection via extractDynamicValues
≤5.1.15Update to 5.1.16
- High7.5Missing Authorization to Setting Manipulation
≤5.1.16Update to 5.1.17
- Critical9.8Missing Authorization to Settings Update and Limited Privilege Escalation
≤5.1.16Update to 5.1.17
- High7.2Authenticated (Administrator+) SQL Injection
≤4.3.25Update to 5.0.0
- High8.3CSV Injection
≤4.3.12Update to 4.3.13
- High8.8Stored Cross-Site Scripting
<3.6.67Update to 3.6.67
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder: common questions
Does Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder have known vulnerabilities?
Yes. VulnCrest Radar lists 47 known vulnerabilities in Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder: 1 critical, 10 high, 36 medium. None are known to affect version null.
How do I check which version of Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder vulnerability?
CVE-2026-120858, published Nov 6, 2026: Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.2.16 - Missing Authorization. Severity: Medium (CVSS 5.3).
Is any Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder vulnerability listed in CISA KEV?
No. None of the known Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder vulnerabilities is currently listed in the CISA KEV catalog.