techjewel Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder vulnerabilities

30 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 13 published in the last 12 months.

Check whether your techjewel Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder version is affected

Latest techjewel Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder vulnerabilities

CVE-2026-5395 — Fluent Forms <= 6.2.0 - Authenticated (Subscriber+) Authorization Bypass via 'table' Parameter (CVSS 8.2)
CVE-2026-5396 — Fluent Forms <= 6.1.21 - Authenticated (Subscriber+) Authorization Bypass via 'form_id' Parameter (CVSS 8.2)
CVE-2026-6828 — Fluent Forms <= 6.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'permission_message' Shortcode Attribute (CVSS 6.4)
CVE-2026-6344 — Fluent Forms <= 6.2.1 - Authenticated (Administrator+) Arbitrary File Read via Path Traversal in Email Attachment (CVSS 4.9)
CVE-2026-4160 — Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.1.21 - Insecure Direct Object Reference in Stripe SCA Confirmation to Unauthenticated Payment Status Modification (CVSS 5.3)
CVE-2026-0996 — Fluent Forms <= 6.1.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via AI Form Builder Module (CVSS 6.4)
CVE-2025-13722 — Fluent Forms <= 6.1.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Form Creation via AI Builder (CVSS 5.3)
CVE-2025-13748 — Fluent Forms <= 6.1.7 - Unauthenticated Insecure Direct Object Reference to Payment Status Tampering via submission_id (CVSS 5.3)
CVE-2025-9260 — Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder 5.1.16 - 6.1.1 - Authenticated (Subscriber+) PHP Object Injection To Arbitrary File Read (CVSS 6.5)
CVE-2025-3615 — Fluent Forms <= 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
CVE-2024-13666 — Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 5.2.12 - IP-Spoofing (CVSS 5.3)
CVE-2024-10646 — Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.2.6 - Unauthenticated Stored Cross-Site Scripting via Form Subject (CVSS 6.1)
CVE-2024-9651 — Contact Form Plugin by Fluent Forms < 5.2.1 - Admin+ Stored XSS (CVSS 6.1)
CVE-2024-9528 — Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Form Manager+) Stored Cross-Site Scripting (CVSS 4.8)
CVE-2024-5053 — Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.18 - Missing Authorization to Authenticated (Subscriber+) Mailchimp Integration Modification (CVSS 4.3)
CVE-2024-6703 — Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Welcome Screen Fields (CVSS 5.4)
CVE-2024-6521 — Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 4.4)
CVE-2024-6520 — Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 4.4)
CVE-2024-6518 — Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 4.4)
CVE-2024-4157 — Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.15 - PHP Object Injection via extractDynamicValues (CVSS 8.8)
CVE-2024-4709 — Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
CVE-2024-2782 — Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Missing Authorization to Setting Manipulation (CVSS 7.5)
CVE-2024-2772 — Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting (CVSS 5.4)
CVE-2024-2771 — Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Missing Authorization to Settings Update and Limited Privilege Escalation (CVSS 9.8)
CVE-2023-6957 — Fluent Forms <= 5.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 5.4)