Fluent Forms <= 6.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'permission_message' Shortcode Attribute

Summary

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'permission_message' parameter in all versions up to, and including, 6.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Timeline

1. May 13, 2026, 4:26 AM UTCCVE published
2. May 13, 2026, 10:07 AM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. May 13, 2026, 10:21 AM UTCRecord last updated

Affected versions

• techjewel Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder

  through 6.2.1

References 6