Fluent Forms Plugin Allows Unauthenticated Stored XSS Attacks

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Notification Smartcode Values in all versions up to, and including, 6.2.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in the browser of an administrator (or any user with the Fluent Forms entry-viewing capability) when they view the form's entry Submission Logs in the WordPress admin dashboard. Exploitation requires that a site administrator or Fluent Forms manager has configured an email notification whose subject or static (direct) Send To value references an attacker-influenced Smartcode such as an input_password field value, a cookie value, or submission.response.

Casky was already ahead

This CVE exploits attack patterns that Casky's 322matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder is a widely-used WordPress plugin that suffers from a stored cross-site scripting (XSS) vulnerability in its notification smartcode functionality. The vulnerability exists in versions up to 6.2.11 and stems from insufficient input sanitization and output escaping when processing notification smartcode values. This allows unauthenticated attackers to inject malicious JavaScript that persists in the database and executes in the browsers of administrators and users with entry-viewing permissions. With a CVSS score of 7.2 (high), this vulnerability poses a significant risk to WordPress sites using this plugin, potentially leading to session hijacking, credential theft, malware distribution, or further compromise of the website and its visitors.

Casky's 322 matching security skills leverage Claude AI's extended reasoning to detect the attack patterns aligned with MITRE ATT&CK techniques TA0001 (Initial Access) and TA0043 (Reconnaissance). Practitioners using Casky would identify indicators such as: suspicious notification smartcode payloads containing script tags or event handlers, anomalous database entries in form notification settings, and client-side execution traces originating from the Fluent Forms plugin components. The platform's skills help practitioners recognize how attackers perform reconnaissance on vulnerable plugin versions, craft encoded payloads to bypass weak sanitization filters, and exploit the trust relationship between administrators and form submission data. Findings would highlight the critical gap between input validation and output escaping, enabling security teams to prioritize patching, implement Web Application Firewalls (WAF) rules, and audit existing form submissions for injected content.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

322 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-18146.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-18146

Casky has 322 skills that investigate the attack patterns behind CVE-2026-18146. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn