Fluent Forms <= 6.2.7 Unauth Stored XSS via Name Field (CVE-2026-16655)

Vulnerability Overview Vulnerability Name: Fluent Forms <= 6.2.7 - Unauthenticated Stored Cross-Site Scripting via Name Field Nested Member CVE ID: CVE-2026-16655 CVSS Score: 7.2 (High) Release Date: July 28, 2026 Last Updated: July 29, 2026 Researchers: dario Impact Scope Software Type: Plugin Software Name: Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder Affected Versions: <= 6.2.7 Fixed Version: 6.2.8 Remediation Fix Method: Update to version 6.2.8 or a later patched version Additional Information Vulnerability Description: The Fluent Forms plugin contains a stored cross-site scripting (XSS) vulnerability. Attackers can inject malicious scripts via the Name Field Nested Member, which execute when users visit the page containing the script. Reference Links: Multiple plugins.trac.wordpress.org links Related Recent Vulnerabilities Fluent Forms <= 6.2.1 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Subscription Cancellation via /subscription_id - CVE ID: CVE-2026-5069 - CVSS Score: 5.4 - Researchers: Fernando Mecozzi - Release Date: July 9, 2026 Fluent Forms <= 6.2.0 - Authenticated (Subscriber+) Authorization Bypass via /table Parameter - CVE ID: CVE-2026-5395 - CVSS Score: 8.2 - Researchers: Sander Horaman - Release Date: May 13, 2026 Fluent Forms <= 6.1.21 - Authenticated (Subscriber+) Authorization Bypass via /form_id Parameter - CVE ID: CVE-2026-5396 - CVSS Score: 8.2 - Researchers: Sander Horaman - Release Date: May 13, 2026 Fluent Forms <= 6.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via /permission_message Shortcode Attribute - CVE ID: CVE-2026-6828 - CVSS Score: 6.4 - Researchers: zaim - Release Date: May 12, 2026 Fluent Forms <= 6.2.1 - Authenticated (Administrator+) Arbitrary File Read via Path Traversal in Email Attachment - CVE ID: CVE-2026-6344 - CVSS Score: 4.9 - Researchers: Niv Kochan - Release Date: May 5, 2026 Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.1.21 - Insecure Direct Object Reference in Stripe SCA Confirmation to Unauthenticated Payment Status Modification - CVE ID: CVE-2026-4160 - CVSS Score: 5.3 - Researchers: Prickly Cactus - Release Date: April 16, 2026 Fluent Forms <= 6.1.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via AI Form Builder Module - CVE ID: CVE-2026-0996 - CVSS Score: 6.4 - Researchers: Osvaldo Nore Gonzalez Del Rio (Os) - Release Date: February 9, 2026 Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.1.14 - Missing Authorization - CVE ID: CVE-2026-25313 - CVSS Score: 4.3 - Researchers: benzdeus - Release Date: January 25, 2026 Fluent Forms <= 6.1.11 - Unauthenticated Arbitrary Shortcode Execution - CVE ID: CVE-2026-69001 - CVSS Score: 6.5 - Researchers: Kishan Vyas - Release Date: January 13, 2026 Fluent Forms <= 6.1.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Form Creation via AI Builder - CVE ID: CVE-2025-13722 - CVSS Score: 5.3 - Researchers: Marcin Dudek (dudekmar) - Release Date: January 6, 2026 Additional Resources View More Vulnerabilities in This Software Package: VIEW MORE VULNERABILITIES IN THIS SOFTWARE PACKAGE Copyright Information Copyright: Copyright 2012-2026 Defiant Inc. MITRE Corporation: 1999-2026 Contact Information Contact Email: wfi-support@wordfence.com Business Hours Business Hours: 9am-8pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT (excluding weekends and holidays) Support Hours: 24/7 support with a 1-hour response time Terms of Service Terms of Service: Terms of Service Privacy Policy: Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information: Do Not Sell or Share My Personal Information Social Media Twitter: X Facebook: f YouTube: ▶ Instagram: 📷 Products and Services Wordfence Free Wordfence Premium Wordfence Care Wordfence Response Wordfence CLI Wordfence Intelligence Wordfence Central Support Documentation Learning Center Free Support Premium Support News Blog In The News Vulnerability Advisories About About Wordfence Affiliate Program Employment Contact Security CVE Request Form Subscribe for Updates Subscribe to News and Updates: Sign up for news and updates from our panel of experienced security professionals. Disclaimer Disclaimer: By checking this box I agree to the terms of service and privacy policy Register Register: SIGN UP Copyright Copyright: © 2012-2026 Defiant Inc. All Rights Reserved Logo Logo**: Defiant

Goal Reached Thanks to every supporter — we hit 100%!

Fluent Forms <= 6.2.7 Unauth Stored XSS via Name Field (CVE-2026-16655)

More from this source