Plugin security history

Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 37 vulnerability records associated with Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder, published between 2021 and 2026.

Dataset last synchronized: 2026-08-02 09:41:47 UTC

At a glance

Security Snapshot

37Total records

1Critical

9High

27Medium

0Low

0Informational

37Patched records

0Currently marked unpatched

2021-06-16First disclosure

2026-07-31Latest disclosure

37 of 37CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2021	1	1 records
2022	1	1 records
2023	3	3 records
2024	15	15 records
2025	4	4 records
2026	13	13 records

Severity Breakdown

Severity	Records	Share
Critical	1	2.7%
High	9	24.3%
Medium	27	73%

Vulnerability-Type Breakdown

Cross-Site Scripting

18 records48.6%

First: 2021. Latest: 2026.

Missing Authorization

12 records32.4%

First: 2023. Latest: 2026.

Other

5 records13.5%

First: 2022. Latest: 2026.

SQL Injection

1 record2.7%

First: 2023. Latest: 2023.

Path Traversal

1 record2.7%

First: 2026. Latest: 2026.

Patch Status

Patched: 37
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

6.2.9
6.2.8
6.2.1
6.2.2
6.2.0
6.1.15
6.1.12
6.1.8
6.1.2
6.0.3
6.0.0
5.2.7
5.2.1
5.1.19
5.1.20
5.1.16
5.1.14
5.1.17
5.1.10
5.1.7
5.0.9
5.0.0
4.3.25
4.3.13
3.6.67

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-6.2.8`	Fluent Forms <= 6.2.8 - Reflected Cross-Site Scripting via 'param'	July 31, 2026	6.2.9	Medium
`*-6.2.8`	Fluent Forms <= 6.2.8 - Unauthenticated Sensitive Information Exposure via Insecure Direct Object Reference and Weak Transaction Hash in 'transaction' Parameter	July 30, 2026	6.2.9	Medium
`*-6.2.7`	Fluent Forms <= 6.2.7 - Unauthenticated Stored Cross-Site Scripting via Name Field Nested `password` Member	July 28, 2026	6.2.8	High
`*-6.2.1`	Fluent Forms <= 6.2.1 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Subscription Cancellation via 'subscription_id'	July 9, 2026	6.2.2	Medium
`*-6.2.0`	Fluent Forms <= 6.2.0 - Authenticated (Subscriber+) Authorization Bypass via 'table' Parameter	May 13, 2026	6.2.1	High
`*-6.1.21`	Fluent Forms <= 6.1.21 - Authenticated (Subscriber+) Authorization Bypass via 'form_id' Parameter	May 13, 2026	6.2.0	High
`*-6.2.1`	Fluent Forms <= 6.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'permission_message' Shortcode Attribute	May 12, 2026	6.2.2	Medium
`*-6.2.1`	Fluent Forms <= 6.2.1 - Authenticated (Administrator+) Arbitrary File Read via Path Traversal in Email Attachment	May 5, 2026	6.2.2	Medium
`6.1.21`	Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.1.21 - Insecure Direct Object Reference in Stripe SCA Confirmation to Unauthenticated Payment Status Modification	April 16, 2026	6.2.0	Medium
`*-6.1.14`	Fluent Forms <= 6.1.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via AI Form Builder Module	February 9, 2026	6.1.15	Medium
`*-6.1.14`	Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.1.14 - Missing Authorization	January 25, 2026	6.1.15	Medium
`*-6.1.11`	FluentForm <= 6.1.11 - Unauthenticated Arbitrary Shortcode Execution	January 13, 2026	6.1.12	Medium
`*-6.1.7`	Fluent Forms <= 6.1.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Form Creation via AI Builder	January 6, 2026	6.1.8	Medium
`*-6.1.7`	Fluent Forms <= 6.1.7 - Unauthenticated Insecure Direct Object Reference to Payment Status Tampering via submission_id	December 5, 2025	6.1.8	Medium
`5.1.16-6.1.1`	Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder 5.1.16 - 6.1.1 - Authenticated (Subscriber+) PHP Object Injection To Arbitrary File Read	September 2, 2025	6.1.2	Medium
`*-6.0.2`	Fluent Forms <= 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting	April 16, 2025	6.0.3	Medium
`*-5.2.12`	Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 5.2.12 - IP-Spoofing	March 21, 2025	6.0.0	Medium
`*-5.2.6`	Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.2.6 - Unauthenticated Stored Cross-Site Scripting via Form Subject	December 13, 2024	5.2.7	High
`*-5.2.0`	Fluent Forms <= 5.2.0 - Authenticated (Admin+) Stored Cross-Site Scripting	November 18, 2024	5.2.1	Medium
`*-5.1.19`	Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Form Manager+) Stored Cross-Site Scripting	October 4, 2024	5.1.20	Medium
`*-5.1.18`	Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.18 - Missing Authorization to Authenticated (Subscriber+) Mailchimp Integration Modification	August 31, 2024	5.1.19	Medium
`*-5.1.19`	Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Administrator+) Stored Cross-Site Scripting	July 26, 2024	5.1.20	Medium
`*-5.1.19`	Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Administrator+) Stored Cross-Site Scripting	July 26, 2024	5.1.20	Medium
`*-5.1.19`	Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Administrator+) Stored Cross-Site Scripting	July 26, 2024	5.1.20	Medium
`*-5.1.19`	Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Welcome Screen Fields	July 26, 2024	5.1.20	Medium

Selected source records

Latest Records

MediumCVE-2026-17571

Fluent Forms <= 6.2.8 - Reflected Cross-Site Scripting via 'param'

Published: July 31, 2026

Affected versions: *-6.2.8
Patched versions: 6.2.9

Original Wordfence record

MediumCVE-2026-17567

Fluent Forms <= 6.2.8 - Unauthenticated Sensitive Information Exposure via Insecure Direct Object Reference and Weak Transaction Hash in 'transaction' Parameter

Published: July 30, 2026

Affected versions: *-6.2.8
Patched versions: 6.2.9

Original Wordfence record

HighCVE-2026-16655

Fluent Forms <= 6.2.7 - Unauthenticated Stored Cross-Site Scripting via Name Field Nested `password` Member

Published: July 28, 2026

Affected versions: *-6.2.7
Patched versions: 6.2.8

Original Wordfence record

MediumCVE-2026-5069

Fluent Forms <= 6.2.1 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Subscription Cancellation via 'subscription_id'

Published: July 9, 2026

Affected versions: *-6.2.1
Patched versions: 6.2.2

Original Wordfence record

HighCVE-2026-5395

Fluent Forms <= 6.2.0 - Authenticated (Subscriber+) Authorization Bypass via 'table' Parameter

Published: May 13, 2026

Affected versions: *-6.2.0
Patched versions: 6.2.1

Original Wordfence record

HighCVE-2026-5396

Fluent Forms <= 6.1.21 - Authenticated (Subscriber+) Authorization Bypass via 'form_id' Parameter

Published: May 13, 2026

Affected versions: *-6.1.21
Patched versions: 6.2.0

Original Wordfence record

MediumCVE-2026-6828

Fluent Forms <= 6.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'permission_message' Shortcode Attribute

Published: May 12, 2026

Affected versions: *-6.2.1
Patched versions: 6.2.2

Original Wordfence record

MediumCVE-2026-6344

Fluent Forms <= 6.2.1 - Authenticated (Administrator+) Arbitrary File Read via Path Traversal in Email Attachment

Published: May 5, 2026

Affected versions: *-6.2.1
Patched versions: 6.2.2

Original Wordfence record

Highest-Severity Records

CriticalCVE-2024-2771

Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Missing Authorization to Settings Update and Limited Privilege Escalation

Published: May 17, 2024

Affected versions: *-5.1.16
Patched versions: 5.1.17

Original Wordfence record

HighCVE-2021-34620

WP Fluent Forms < 3.6.67 - Stored Cross-Site Scripting

Published: June 16, 2021

Affected versions: [*, 3.6.67)
Patched versions: 3.6.67

Original Wordfence record

HighCVE-2022-3463

Contact Form Plugin by FluentForm <= 4.3.12 - CSV Injection

Published: October 17, 2022

Affected versions: *-4.3.12
Patched versions: 4.3.13

Original Wordfence record

HighCVE-2026-5396

Fluent Forms <= 6.1.21 - Authenticated (Subscriber+) Authorization Bypass via 'form_id' Parameter

Published: May 13, 2026

Affected versions: *-6.1.21
Patched versions: 6.2.0

Original Wordfence record

HighCVE-2026-5395

Fluent Forms <= 6.2.0 - Authenticated (Subscriber+) Authorization Bypass via 'table' Parameter

Published: May 13, 2026

Affected versions: *-6.2.0
Patched versions: 6.2.1

Original Wordfence record

HighCVE-2024-2782

Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Missing Authorization to Setting Manipulation

Published: May 17, 2024

Affected versions: *-5.1.16
Patched versions: 5.1.17

Original Wordfence record

HighCVE-2024-4157

Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.15 - PHP Object Injection via extractDynamicValues

Published: May 21, 2024

Affected versions: *-5.1.15
Patched versions: 5.1.16

Original Wordfence record

HighCVE-2024-10646

Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.2.6 - Unauthenticated Stored Cross-Site Scripting via Form Subject

Published: December 13, 2024

Affected versions: *-5.2.6
Patched versions: 5.2.7

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory