Plugin icon

Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder

fluentform

Vulnerabilities:

25

Last Updated:

January 14, 2026

Active Installs:

600000

Published
Title
Fixed in
CVSS
Published
2026-01-06
Title
Fluent Forms < 6.1.8 - Subscriber+ Arbitrary Form Creation via AI Builder
Fixed in
Fixed in 6.1.8
CVSS
4.3 (medium)
Published
2025-12-05
Title
Fluent Forms < 6.1.8 - Unauthenticated Payment Status Tampering via IDOR
Fixed in
Fixed in 6.1.8
CVSS
5.3 (medium)
Published
2025-09-02
Title
Fluent Forms 5.1.16 - 6.1.0 - Subscriber+ PHP Object Injection To Arbitrary File Read
Fixed in
Fixed in 6.1.1
CVSS
6.5 (medium)
Published
2025-04-16
Title
Fluent Forms < 6.0.3 - Contributor+ Stored XSS
Fixed in
Fixed in 6.0.3
CVSS
5.9 (medium)
Published
2025-03-21
Title
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder < 6.0.0 - IP-Spoofing
Fixed in
Fixed in 6.0.0
CVSS
5.3 (medium)
Published
2024-12-13
Title
Contact Form Plugin by Fluent Forms < 5.2.7 - Unauthenticated Stored XSS via Form Subject
Fixed in
Fixed in 5.2.7
CVSS
8.8 (high)
Published
2024-11-18
Title
Contact Form Plugin by Fluent Forms < 5.2.1 - Admin+ Stored XSS
Fixed in
Fixed in 5.2.1
CVSS
3.5 (low)
Published
2024-10-04
Title
Contact Form Plugin by Fluent Forms < 5.1.20 - Form Manager+ Stored XSS
Fixed in
Fixed in 5.1.20
CVSS
3.5 (low)
Published
2024-08-31
Title
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder < 5.1.19 - Missing Authorization to Authenticated (Subscriber+) Mailchimp Integration Modification
Fixed in
Fixed in 5.1.19
CVSS
4.2 (medium)
Published
2024-07-26
Title
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder < 5.1.20 - Authenticated (Administrator+) Stored Cross-Site Scripting
Fixed in
Fixed in 5.1.20
CVSS
4.4 (medium)
Published
2024-07-26
Title
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder < 5.1.20 - Authenticated (Administrator+) Stored Cross-Site Scripting
Fixed in
Fixed in 5.1.20
CVSS
5.5 (medium)
Published
2024-07-26
Title
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder < 5.1.20 - Authenticated (Administrator+) Stored Cross-Site Scripting
Fixed in
Fixed in 5.1.20
CVSS
4.4 (medium)
Published
2024-07-26
Title
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder < 5.1.20 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Welcome Screen Fields
Fixed in
Fixed in 5.1.20
CVSS
4.9 (medium)
Published
2024-05-21
Title
Contact Form Plugin by Fluent Forms < 5.1.16 - Contributor+ PHP Object Injection
Fixed in
Fixed in 5.1.16
CVSS
6.6 (medium)
Published
2024-05-17
Title
Contact Form Plugin by Fluent Forms < 5.1.17 - Unauthenticated Settings Update
Fixed in
Fixed in 5.1.17
CVSS
5.3 (medium)
Published
2024-05-17
Title
Contact Form Plugin by Fluent Forms < 5.1.17 - Contributor+ Stored XSS
Fixed in
Fixed in 5.1.17
CVSS
5.9 (medium)
Published
2024-05-17
Title
Contact Form Plugin by Fluent Forms < 5.1.17 - Unauthenticated Limited Privilege Escalation
Fixed in
Fixed in 5.1.17
CVSS
6.5 (medium)
Published
2024-05-17
Title
Contact Form Plugin by Fluent Forms < 5.1.14 - Subscriber+ Stored XSS
Fixed in
Fixed in 5.1.14
CVSS
6.4 (medium)
Published
2024-03-05
Title
Fluent Forms < 5.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 5.1.10
CVSS
4.9 (medium)
Published
2024-01-18
Title
Fluent Forms < 5.1.7 - Admin+ Stored Cross-Site Scripting via imported form title
Fixed in
Fixed in 5.1.7
CVSS
4.4 (medium)
Published
2023-09-08
Title
Contact Form for Plugin by Fluent Forms < 5.0.9 - Insecure Direct Object Reference
Fixed in
Fixed in 5.0.9
CVSS
5.3 (medium)
Published
2023-07-12
Title
FluentForm < 5.0.0 - SQL Injection
Fixed in
Fixed in 5.0.0
CVSS
4.1 (medium)
Published
2023-03-20
Title
FluentForms < 4.3.25 - Contributor+ Stored XSS via Custom HTML Form Field
Fixed in
Fixed in 4.3.25
CVSS
6.8 (medium)
Published
2022-10-17
Title
FluentForm < 4.3.13 - CSV Injection
Fixed in
Fixed in 4.3.13
CVSS
3.4 (low)
Published
2021-06-17
Title
WP Fluent Forms < 3.6.67 - Cross-Site Request Forgery (CSRF)
Fixed in
Fixed in 3.6.67
CVSS
7.1 (high)