CVE-2026-16655 in Fluent Forms Plugin
Summary
by MITRE • 07/29/2026
The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Name Field Nested `password` Member in all versions up to, and including, 6.2.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/29/2026
The Fluent Forms plugin for WordPress represents a widely used tool for creating customizable contact forms, surveys, quizzes, and conversational form builders across millions of websites. This vulnerability affects all versions up to and including 6.2.7, making it a critical concern for WordPress administrators managing sites that utilize this plugin. The stored cross-site scripting vulnerability specifically targets the Name Field Nested password member, indicating a flaw in how the plugin processes and sanitizes user input within form field configurations.
The technical flaw stems from insufficient input sanitization and output escaping mechanisms within the plugin's codebase. When users create forms with nested fields that include password members within name fields, the plugin fails to properly sanitize or escape the input data before storing it in the database. This allows attackers to inject malicious scripts that persist in the form configuration and execute whenever any user accesses pages containing the compromised form data. The vulnerability operates at the storage level rather than the input level, making it particularly dangerous as the malicious code becomes embedded within the WordPress database itself.
The operational impact of this vulnerability extends beyond simple script execution, as it provides attackers with persistent access vectors that can be leveraged for various malicious activities. Unauthenticated attackers can exploit this weakness to inject scripts that may steal user credentials, redirect visitors to malicious websites, or perform actions on behalf of authenticated users who view compromised pages. The stored nature of the vulnerability means that once a form is injected with malicious code, it remains active until manually removed by administrators, potentially affecting numerous users over extended periods.
From a cybersecurity perspective, this vulnerability aligns with CWE-79 (Cross-site Scripting) and represents a classic example of how insufficient input validation can create persistent security risks. The ATT&CK framework categorizes this as a technique for code injection and privilege escalation, as the malicious scripts could potentially be used to establish footholds within compromised WordPress environments. Organizations should prioritize immediate patching of vulnerable versions while implementing monitoring for suspicious form configurations and user access patterns that might indicate exploitation attempts.
Mitigation strategies include upgrading to patched versions of the Fluent Forms plugin immediately, implementing robust input validation measures at multiple levels, and establishing regular security audits of form configurations. Administrators should also consider implementing content security policies and monitoring for unexpected script injections in their WordPress environments. The vulnerability demonstrates the critical importance of proper sanitization and escaping mechanisms in web applications, particularly when handling user-generated content that may be stored and subsequently displayed to other users.