| CVE-2026-5395 |
Fluent Forms <= 6.2.0 - Authenticated (Subscriber+) Authorization Bypass via 'table' Parameter
— Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
CWE-639
|
8.2
|
High
|
2026-05-14 |
| CVE-2026-5396 |
Fluent Forms <= 6.1.21 - Authenticated (Subscriber+) Authorization Bypass via 'form_id' Parameter
— Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
CWE-639
|
8.2
|
High
|
2026-05-14 |
| CVE-2026-6828 |
Fluent Forms <= 6.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'permission_message' Shortcode Attribute
— Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
CWE-79
|
6.4
|
Medium
|
2026-05-13 |
| CVE-2026-6344 |
Fluent Forms <= 6.2.1 - Authenticated (Administrator+) Arbitrary File Read via Path Traversal in Email Attachment
— Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
CWE-22
|
4.9
|
Medium
|
2026-05-06 |
| CVE-2026-4160 |
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.1.21 - Insecure Direct Object Reference in Stripe SCA Confirmation to Unauthenticated Payment Status Modification
— Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
CWE-639
|
5.3
|
Medium
|
2026-04-16 |
| CVE-2026-0996 |
Fluent Forms <= 6.1.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via AI Form Builder Module
— Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
CWE-79
|
6.4
|
Medium
|
2026-02-10 |
| CVE-2025-13722 |
Fluent Forms <= 6.1.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Form Creation via AI Builder
— Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
CWE-862
|
5.3
|
Medium
|
2026-01-07 |
| CVE-2025-13748 |
Fluent Forms <= 6.1.7 - Unauthenticated Insecure Direct Object Reference to Payment Status Tampering via submission_id
— Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
CWE-639
|
5.3
|
Medium
|
2025-12-06 |
| CVE-2025-9260 |
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder 5.1.16 - 6.1.1 - Authenticated (Subscriber+) PHP Object Injection To Arbitrary File Read
— Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
CWE-502
|
6.5
|
Medium
|
2025-09-02 |
| CVE-2025-3615 |
Fluent Forms <= 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
— Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
CWE-79
|
6.4
|
Medium
|
2025-04-17 |
| CVE-2024-13666 |
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 5.2.12 - IP-Spoofing
— Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
CWE-20
|
5.3
|
Medium
|
2025-03-22 |
| CVE-2024-10646 |
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.2.6 - Unauthenticated Stored Cross-Site Scripting via Form Subject
— Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
CWE-79
|
7.2
|
High
|
2024-12-14 |
| CVE-2024-9528 |
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Form Manager+) Stored Cross-Site Scripting
— Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
CWE-79
|
4.9
|
Medium
|
2024-10-05 |
| CVE-2024-5053 |
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.18 - Missing Authorization to Authenticated (Subscriber+) Mailchimp Integration Modification
— Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
CWE-285
|
4.2
|
Medium
|
2024-09-01 |
| CVE-2024-6703 |
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Welcome Screen Fields
— Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
CWE-79
|
4.9
|
Medium
|
2024-07-27 |
| CVE-2024-6518 |
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Administrator+) Stored Cross-Site Scripting
— Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
CWE-79
|
4.4
|
Medium
|
2024-07-27 |
| CVE-2024-6520 |
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Administrator+) Stored Cross-Site Scripting
— Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
CWE-79
|
4.4
|
Medium
|
2024-07-27 |
| CVE-2024-6521 |
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Administrator+) Stored Cross-Site Scripting
— Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
CWE-79
|
4.4
|
Medium
|
2024-07-27 |
| CVE-2024-4157 |
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.15 - PHP Object Injection via extractDynamicValues
— Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
CWE-502
|
7.5
|
High
|
2024-05-22 |
| CVE-2024-4709 |
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Authenticated (Contributor+) Stored Cross-Site Scripting
— Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
CWE-79
|
6.4
|
Medium
|
2024-05-18 |
| CVE-2024-2772 |
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting
— Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
CWE-79
|
6.4
|
Medium
|
2024-05-18 |
| CVE-2024-2782 |
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Missing Authorization to Setting Manipulation
— Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
CWE-862
|
7.5
|
High
|
2024-05-18 |
| CVE-2024-2771 |
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Missing Authorization to Settings Update and Limited Privilege Escalation
— Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
CWE-862
|
9.8
|
Critical
|
2024-05-18 |
| CVE-2023-6957 |
Fluent Forms <= 5.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
— Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
CWE-79
|
4.9
|
Medium
|
2024-03-13 |
| CVE-2024-0618 |
Fluent Forms <= 5.1.5 - Authenticated(Administrator+) Stored Cross-Site Scripting via imported form title
— Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
CWE-79
|
4.4
|
Medium
|
2024-01-27 |