Vulnerability · Published Jul 30, 2026 · Assigned by WPScan

CVE-2026-11881Fluent Forms < 6.2.6 - Contributor+ Stored XSS via Date/Time Field

Medium 6.1

In plain English

A medium-severity cross-site scripting in Fluent Forms from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.3%top 83.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

The Fluent Forms WordPress plugin before 6.2.6 does not sanitise and escape one of its form field configuration settings before outputting it inside an inline script when a form is rendered, which could allow users with a role as low as Contributor (with delegated form-management permission, and therefore lacking the unfiltered_html capability, e.g. in a multisite setup) to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor who loads the form, including administrators previewing it.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Fluent Forms	0 – before 6.2.6

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

https://wpscan.com/vulnerability/3ccc3b34-44ed-4489-86e5-4c0ae800ef73/ exploit, vdb-entry, technical-description