Executive Summary

The Fluent Forms plugin for WordPress has a Stored Cross-Site Scripting (XSS) vulnerability in its AI Form Builder module in all versions up to and including 6.1.14. This vulnerability arises due to missing authorization checks, a leaked nonce, and insufficient input sanitization.

Subscriber-level users can trigger AI form generation through a protected endpoint. The AI services typically return bare JavaScript code without <script> tags, which bypasses the plugin's sanitization mechanisms.

This stored JavaScript code executes whenever anyone views the generated form, allowing authenticated attackers with Subscriber-level access or higher to inject arbitrary web scripts that run in the context of any user accessing the form.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers with Subscriber-level access to inject and store malicious JavaScript code within forms generated by the AI Form Builder module.

When other users view these forms, the malicious scripts execute in their browsers, potentially leading to theft of sensitive information, session hijacking, or other malicious actions performed in the context of the affected users.

Because the attack can be performed by low-privileged users and affects all users who view the form, it poses a significant security risk to the website and its users.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

I don't know

Useful 0 Not Useful 0

Mitigation Strategies

I don't know

Useful 0 Not Useful 0