CVE-2026-18146

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Notification Smartcode Values in all versions up to, and including, 6.2.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in the browser of an administrator (or any user with the Fluent Forms entry-viewing capability) when they view the form's entry Submission Logs in the WordPress admin dashboard. Exploitation requires that a site administrator or Fluent Forms manager has configured an email notification whose subject or static (direct) Send To value references an attacker-influenced Smartcode such as an input_password field value, a cookie value, or submission.response.

• CWE-79

• https://plugins.trac.wordpress.org/browser/fluentform/tags/6.2.8/app/Services/FormBuilder/Notifications/EmailNotification.php#L196
• https://plugins.trac.wordpress.org/browser/fluentform/tags/6.2.8/app/Services/FormBuilder/ShortCodeParser.php#L142
• https://plugins.trac.wordpress.org/browser/fluentform/tags/6.2.8/app/Services/FormBuilder/ShortCodeParser.php#L145
• https://plugins.trac.wordpress.org/browser/fluentform/tags/6.2.8/assets/js/form_entries.js#L2
• https://plugins.trac.wordpress.org/browser/fluentform/tags/6.2.8/boot/globals.php#L98
• https://plugins.trac.wordpress.org/changeset/3640683/fluentform/trunk/app/Services/FormBuilder/ShortCodeParser.php
• https://plugins.trac.wordpress.org/changeset?old_path=%2Ffluentform/tags/6.2.11&new_path=%2Ffluentform/tags/6.2.12
• https://plugins.trac.wordpress.org/changeset?reponame=&new=3640683%40fluentform%2Ftags%2F6.2.12&old=3632883%40fluentform%2Ftags%2F6.2.11
• https://www.wordfence.com/threat-intel/vulnerabilities/id/643f92e2-b14e-4056-97fc-1c631027c54f?source=cve

Published

Aug 13, 2026

Last Modified

Aug 14, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-18137IBM Financial Transaction Manager (FTM) for RedHat OpenShift…8.1
• CVE-2026-1814Rapid7 Nexpose versions 6.4.50 and later are vulnerable to a…6.8
• CVE-2026-18140Uncontrolled recursion in the unknown-key skip path of the a…8.7
• CVE-2026-18141A flaw was found in aap-gateway, a component of Ansible Auto…8.2
• CVE-2026-18143The Request a Quote for WooCommerce plugin for WordPress is …9.8
• CVE-2026-18144IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authentica…4.3
• CVE-2026-18147A flaw was found in FreeIPA. An unauthenticated remote attac…8.1
• CVE-2026-18148IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authentica…4.3
• CVE-2026-18149undici's retry handler can leave an already-exposed response…5.9
• CVE-2026-1815Insufficient session expiration vulnerability in Turkiye Ele…5.7
• CVE-2026-18150IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authentica…5.3
• CVE-2026-18151IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authentica…4.2