GCVE - cpe:2.3:a:unknown:fluent_forms:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:unknown:fluent_forms:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Unknown (`668ca391-a6cc-5e33-879b-83885214de33`)
Product	Fluent Forms (`47f14c19-cc27-521c-9992-c3fdf3ebb86a`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-11881`	vulnerable	2026-09-16 04:32:46.458759	Fluent Forms < 6.2.6 - Contributor+ Stored XSS via Date/Time Field The Fluent Forms WordPress plugin before 6.2.6 does not sanitise and escape one of its form field configuration settings before outputting it inside an inline script when a form is rendered, which could allow users with a role as low as Contributor (with delegated form-management permission, and therefore lacking the unfiltered_html capability, e.g. in a multisite setup) to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor who loads the form, including administrators previewing it. Published: 2026-07-30T06:00:10.415Z Updated: 2026-07-30T12:36:35.949Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/3ccc3b34-44ed-4489-86e5-4c0ae800ef73/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-11880`	vulnerable	2026-07-29 00:23:31.757249	Fluent Forms < 6.2.1 - Subscriber+ Subscription Cancellation via IDOR The Fluent Forms WordPress plugin before 6.2.1 does not properly verify ownership before processing a subscription cancellation request, allowing authenticated users with a low-privilege account to cancel subscriptions belonging to other users. Published: 2026-07-01T06:00:02.543Z Updated: 2026-07-01T10:17:33.638Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/5de7c9e9-3a47-4bc6-a1b2-33eb8d3e3ec0/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-11578`	vulnerable	2026-07-29 00:23:31.454070	Fluent Forms < 6.2.5 - Form Manager+ Cross-Form Submission Entry Deletion via IDOR The Fluent Forms WordPress plugin before 6.2.5 does not properly restrict the deletion of form submission entries to the forms a restricted Manager is authorized to manage, allowing a Manager limited to specific forms to permanently delete submission entries belonging to other forms. This requires a non-default configuration in which an administrator has created at least one Manager restricted to specific forms. Published: 2026-07-02T06:00:02.573Z Updated: 2026-07-02T12:54:19.224Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/3937e20f-dd46-4c2e-b170-d5e5c254b8d2/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-9651`	vulnerable	2026-06-08 07:00:28.395614	Contact Form Plugin by Fluent Forms < 5.2.1 - Admin+ Stored XSS The Fluent Forms WordPress plugin before 5.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Published: 2024-12-09T06:00:05.625Z Updated: 2024-12-09T17:53:31.752Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/a2c56e42-3b3a-4e23-933f-40cf63e222c0/	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.