CVE-2026-101324
Received Received - Intake

Reflected Cross-Site Scripting in Fluent Forms WordPress Plugin

Publication date: 2026-10-10

Last updated on: 2026-10-10

Assigner: Wordfence

Description
The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'any attacker-chosen name matching the {get.NAME} placeholder (PoC uses 'proof')' parameter in all versions up to, and including, 6.2.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires a site administrator to have configured a Custom HTML field on a published form containing a {get.*} SmartCode inside a URL-accepting attribute such as iframe src or a href — a documented Fluent Forms feature.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-10
Last Modified
2026-10-10
Generated
2026-10-10
AI Q&A
2026-10-10
EPSS Evaluated
N/A
NVD
CVE-2026-101324
EUVD
EUVD-2026-96056

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wpmanageninja Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Reflected Cross-Site Scripting (XSS) issue in the Fluent Forms WordPress plugin. It allows unauthenticated attackers to inject malicious scripts into web pages by exploiting insufficient input sanitization and output escaping in the 'any attacker-chosen name matching the {get.NAME} placeholder' parameter. The attack requires tricking a user into clicking a link and relies on a site administrator having configured a Custom HTML field with a {get.*} SmartCode in a URL attribute like iframe src or href.

Detection Guidance

This vulnerability is specific to WordPress sites using the Fluent Forms plugin. Detection requires checking plugin versions and inspecting forms for {get.*} SmartCode in Custom HTML fields with URL-accepting attributes like iframe src or a href. No direct network commands detect this; manual inspection of WordPress admin panels is needed.

Impact Analysis

An attacker could steal sensitive user data like cookies or session tokens, redirect users to malicious sites, or perform actions on their behalf. Users with administrative access could be particularly targeted, leading to further compromise of the WordPress site.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles. For HIPAA, it may expose protected health information if forms collect such data, risking non-compliance with security requirements.

Mitigation Strategies

Immediately update the Fluent Forms plugin to the latest version beyond 6.2.14. Remove any Custom HTML fields containing {get.*} SmartCode in URL-accepting attributes. Review forms for suspicious links or scripts. If compromised, clean affected pages and audit user accounts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-101324. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart