CVE-2024-6520

The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom error message in all versions up to, and including, 5.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

• CWE-79
• CWE-79

• https://plugins.trac.wordpress.org/changeset/3125227/Patch
• https://wordpress.org/plugins/fluentform/#developersRelease Notes
• https://www.wordfence.com/threat-intel/vulnerabilities/id/0a30d35c-9883-4b0f-83a2-494401c45d8e?source=cveThird Party Advisory
• https://plugins.trac.wordpress.org/changeset/3125227/Patch
• https://wordpress.org/plugins/fluentform/#developersRelease Notes
• https://www.wordfence.com/threat-intel/vulnerabilities/id/0a30d35c-9883-4b0f-83a2-494401c45d8e?source=cveThird Party Advisory

Published

Jul 27, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-6513Rejected reason: CVE assigned by mistake as a duplicate.
• CVE-2024-6515Web browser interface may manipulate application username/pa…8.1
• CVE-2024-6516Cross Site Scripting vulnerabilities where found providing a…6.1
• CVE-2024-6517The Contact Form 7 Math Captcha WordPress plugin through 2.0…6.1
• CVE-2024-6518The Contact Form Plugin by Fluent Forms for Quiz, Survey, an…4.4
• CVE-2024-6519A use-after-free vulnerability was found in the QEMU LSI53C8…8.2
• CVE-2024-6521The Contact Form Plugin by Fluent Forms for Quiz, Survey, an…4.4
• CVE-2024-6522The Modern Events Calendar plugin for WordPress is vulnerabl…9.6
• CVE-2024-6523A vulnerability was found in ZKTeco BioTime up to 9.5.2. It …5.4
• CVE-2024-6524A vulnerability was found in ShopXO up to 6.1.0. It has been…8.8
• CVE-2024-6525** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in…8.8
• CVE-2024-6526A vulnerability classified as problematic has been found in …6.1