Filtered by vendor Fluent Forms
Subscriptions
Filtered by product Fluent Forms
Subscriptions
Total
2 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-11881 | 2 Fluent Forms, Wordpress | 2 Fluent Forms, Wordpress | 2026-07-30 | N/A |
| The Fluent Forms WordPress plugin before 6.2.6 does not sanitise and escape one of its form field configuration settings before outputting it inside an inline script when a form is rendered, which could allow users with a role as low as Contributor (with delegated form-management permission, and therefore lacking the unfiltered_html capability, e.g. in a multisite setup) to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor who loads the form, including administrators previewing it. | ||||
| CVE-2026-11880 | 2 Fluent Forms, Wordpress | 2 Fluent Forms, Wordpress | 2026-07-29 | 3.1 Low |
| The Fluent Forms WordPress plugin before 6.2.1 does not properly verify ownership before processing a subscription cancellation request, allowing authenticated users with a low-privilege account to cancel subscriptions belonging to other users. | ||||
Page 1 of 1.