CVE-2026-2365

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

The Fluent Forms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `fluentform_step_form_save_data` AJAX action in all versions up to, and including, 6.1.17. This is due to the draft form submission endpoint being publicly accessible without authentication or nonce verification, combined with insufficient input sanitization and output escaping of form field data. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrator views a partial form entry.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Mar 5, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-236516.7Permissive regular expression in Azure Compute Gallery allows an authorized attacker to elevate privileges locally.CVE-2026-236529.8Improper neutralization of special elements used in a command ('command injection') in Microsoft Power Pages allows an unauthorized attacker CVE-2026-236536.5Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an autho CVE-2026-236548.8Dependency on vulnerable third-party component in GitHub Repo: zero-shot-scfoundation allows an unauthorized attacker to execute code over a CVE-2026-236556.5Cleartext storage of sensitive information in Azure Compute Gallery allows an authorized attacker to disclose information over a network.CVE-2026-236565.9Insufficient verification of data authenticity in Windows App Installer allows an unauthorized attacker to perform spoofing over a network.CVE-2026-236577.8Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.CVE-2026-236589.8Insufficiently protected credentials in Azure DevOps allows an unauthorized attacker to elevate privileges over a network.CVE-2026-236597.5Exposure of sensitive information to an unauthorized actor in Azure Data Factory allows an unauthorized attacker to disclose information ove CVE-2026-23663.1A flaw was found in Keycloak. An authorization bypass vulnerability in the Keycloak Admin API allows any authenticated user, even those with CVE-2026-236607.8Improper access control in Azure Portal Windows Admin Center allows an authorized attacker to elevate privileges locally.CVE-2026-236617.5Cleartext transmission of sensitive information in Azure IoT Explorer allows an unauthorized attacker to disclose information over a network