CVE-2026-17571
Received Received - Intake

Reflected Cross-Site Scripting in Fluent Forms WordPress Plugin

Publication date: 2026-08-01

Last updated on: 2026-08-01

Assigner: Wordfence

Description
The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'param' in all versions up to, and including, 6.2.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-01
Last Modified
2026-08-01
Generated
2026-08-01
AI Q&A
2026-08-01
EPSS Evaluated
N/A
NVD
CVE-2026-17571
EUVD
EUVD-2026-51790

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wpmet fluent_forms to 6.2.8 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Reflected Cross-Site Scripting (XSS) issue in the Fluent Forms WordPress plugin. It allows unauthenticated attackers to inject malicious scripts into web pages by tricking users into clicking a link. The flaw exists due to insufficient input sanitization and output escaping in the 'param' parameter.

Detection Guidance

This vulnerability involves reflected Cross-Site Scripting (XSS) in the Fluent Forms WordPress plugin. Detection requires checking if the plugin version is up to 6.2.8 or older. No specific commands are provided in the context, but you can inspect WordPress plugins via the admin dashboard or check the plugin files for version details.

Impact Analysis

An attacker could exploit this to execute arbitrary scripts in your browser when visiting a crafted link. This may lead to session hijacking, stealing cookies, or redirecting you to malicious sites. Users with admin access are at higher risk if tricked into clicking such a link.

Compliance Impact

This XSS vulnerability could lead to unauthorized access to user data, violating GDPR's data protection requirements. For HIPAA, it may compromise protected health information if exploited. Organizations must patch quickly to maintain compliance.

Mitigation Strategies

Immediately update the Fluent Forms plugin to the latest version beyond 6.2.8. If an update is unavailable, consider temporarily disabling or removing the plugin until a patch is released. Monitor WordPress security advisories for updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-17571. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart