CVE-2026-101324

Name of the Vulnerable Software and Affected Versions Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder versions prior to 6.2.15

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting (XSS), a technique where malicious scripts are injected into a web page and executed in the victim's browser. This occurs via any attacker-chosen name matching the {get.NAME} placeholder (such as proof) parameter. Exploitation is possible if a site administrator has configured a Custom HTML field on a published form containing a {get.*} SmartCode within a URL-accepting attribute, such as iframe src or a href.

Recommendations Update the plugin to version 6.2.15 or later. As a temporary mitigation, avoid using {get.*} SmartCodes within URL-accepting attributes in Custom HTML fields on published forms.