Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.1

Fluent Forms < 6.2.6 - Malicious Code in Form Date/Time Fields

CVE-2026-11881 · published 3 months ago
Summary

The Fluent Forms WordPress plugin is vulnerable to a security threat that allows attackers to inject malicious code into form fields. This can lead to unauthorized actions when visitors view the form. To fix this, update the plugin to version 6.2.6 or higher.

What to do
  • Update unknown fluent forms to version 6.2.6 or later.
Affected software
VendorProductAffected versions
unknown fluent forms < 6.2.6
Original advisory text
The Fluent Forms WordPress plugin before 6.2.6 does not sanitise and escape one of its form field configuration settings before outputting it inside an inline script when a form is rendered, which...
The Fluent Forms WordPress plugin before 6.2.6 does not sanitise and escape one of its form field configuration settings before outputting it inside an inline script when a form is rendered, which could allow users with a role as low as Contributor (with delegated form-management permission, and therefore lacking the unfiltered_html capability, e.g. in a multisite setup) to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor who loads the form, including administrators previewing it.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
6.1 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published30 Jul 2026
Updated4 Nov 2026
First seen30 Jul 2026
Sources
CVE-2026-11881 · NVD
CVE-2026-11881 · MITRE
Track software like this
Free during beta