CVE-2026-15962Fluent Forms Pro Add On Pack <= 6.2.6 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary User Password Change via User Meta Field Exploitation status Not known exploited Fix Affected product F Fluent Forms Pro Add On Pack Published 07/26/2026 Severity High CVE-2026-8977WP GDPR Cookie Consent <= 1.0.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'ninja_gdpr_ajax_actions' AJAX Action Exploitation status Not known exploited Fix Affected product W WP GDPR Cookie Consent Published 06/09/2026 Severity Medium CVE-2026-7798FluentCRM <= 2.9.87 - Unauthenticated Blind Server-Side Request Forgery via 'SubscribeURL' Parameter Exploitation status Not known exploited Fix Affected product F FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution Published 05/22/2026 Severity Medium CVE-2026-5395Fluent Forms <= 6.2.0 - Authenticated (Subscriber+) Authorization Bypass via 'table' Parameter Exploitation status Not known exploited Fix Affected product F Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder Published 05/14/2026 Severity High CVE-2026-5396Fluent Forms <= 6.1.21 - Authenticated (Subscriber+) Authorization Bypass via 'form_id' Parameter Exploitation status Not known exploited Fix Affected product F Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder Published 05/14/2026 Severity High CVE-2026-6828Fluent Forms <= 6.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'permission_message' Shortcode Attribute Exploitation status Not known exploited Fix Affected product F Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder Published 05/13/2026 Severity Medium CVE-2026-6344Fluent Forms <= 6.2.1 - Authenticated (Administrator+) Arbitrary File Read via Path Traversal in Email Attachment Exploitation status Not known exploited Fix Affected product F Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder Published 05/06/2026 Severity Medium CVE-2026-2306Ninja Tables <= 5.2.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Table Creation Exploitation status Not known exploited Fix Affected product N Ninja Tables – Easy Data Table Builder Published 05/06/2026 Severity Medium CVE-2026-4160Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.1.21 - Insecure Direct Object Reference in Stripe SCA Confirmation to Unauthenticated Payment Status Modification Exploitation status Not known exploited Fix Not confirmed Affected product F Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder Published 04/16/2026 Severity Medium CVE-2026-2231Fluent Booking <= 2.0.01 - Unauthenticated Stored Cross-Site Scripting via Multiple Parameters Exploitation status Not known exploited Fix Affected product F Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution Published 03/26/2026 Severity High CVE-2026-2899Fluent Forms Pro Add On Pack <= 6.1.17 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion Exploitation status Not known exploited Fix Affected product F Fluent Forms Pro Add On Pack Published 03/05/2026 Severity Medium CVE-2026-2365Fluent Forms Pro <= 6.1.17 - Unauthenticated Stored Cross-Site Scripting via Draft Form Submission Exploitation status Not known exploited Fix Affected product F Fluent Forms Pro Add On Pack Published 03/05/2026 Severity High CVE-2026-2428Fluent Forms Pro Add On Pack <= 6.1.17 - Missing Authorization to Unauthenticated Payment Status modification Exploitation status Not known exploited Fix Affected product F Fluent Forms Pro Add On Pack Published 02/27/2026 Severity High CVE-2026-0996Fluent Forms <= 6.1.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via AI Form Builder Module Exploitation status Not known exploited Fix Affected product F Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder Published 02/10/2026 Severity Medium CVE-2026-0632Fluent Forms Pro Add On Pack <= 6.1.12 - Authenticated (Subscriber+) Server-Side Request Forgery via 'saveDataSource' Exploitation status Not known exploited Fix Affected product F Fluent Forms Pro Add On Pack Published 02/09/2026 Severity Medium CVE-2025-13722Fluent Forms <= 6.1.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Form Creation via AI Builder Exploitation status Not known exploited Fix Affected product F Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder Published 01/07/2026 Severity Medium CVE-2025-13728FluentAuth - Auth Security Plugin <= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fluent_auth_reset_password' Shortcode Exploitation status Not known exploited Fix Affected product F FluentAuth – The Ultimate Authorization & Security Plugin for WordPress Published 12/15/2025 Severity Medium CVE-2025-13748Fluent Forms <= 6.1.7 - Unauthenticated Insecure Direct Object Reference to Payment Status Tampering via submission_id Exploitation status Not known exploited Fix Affected product F Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder Published 12/06/2025 Severity Medium CVE-2025-13756Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution <= 1.9.11 - Authenticated (Subscriber+) Missing Authorization to Calendar Import and Management Exploitation status Not known exploited Fix Affected product F Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution Published 12/03/2025 Severity Medium CVE-2025-12935FluentCRM - Marketing Automation For WordPress <= 2.9.84 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fluentcrm_content' Shortcode Exploitation status Not known exploited Fix Affected product F FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution Published 11/21/2025 Severity Medium CVE-2025-9260Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder 5.1.16 - 6.1.1 - Authenticated (Subscriber+) PHP Object Injection To Arbitrary File Read Exploitation status Not known exploited Fix Affected product F Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder Published 09/02/2025 Severity Medium CVE-2025-2940Ninja Tables – Easy Data Table Builder <= 5.0.18 - Unauthenticated Server-Side Request Forgery Exploitation status Not known exploited Fix Affected product N Ninja Tables – Easy Data Table Builder Published 06/27/2025 Severity High CVE-2025-2939Ninja Tables – Easy Data Table Builder <= 5.0.18 - Unauthenticated PHP Object Injection to Limited Remote Code Execution Exploitation status Not known exploited Fix Affected product N Ninja Tables – Easy Data Table Builder Published 06/03/2025 Severity Medium CVE-2025-3615Fluent Forms <= 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product F Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder Published 04/17/2025 Severity Medium CVE-2024-13666Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 5.2.12 - IP-Spoofing Exploitation status Not known exploited Fix Affected product F Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder Published 03/22/2025 Severity Medium CVE-2024-13568Fluent Support – Helpdesk & Customer Support Ticket System <= 1.8.5 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory Exploitation status Not known exploited Fix Affected product F Fluent Support – Helpdesk & Customer Support Ticket System Published 03/01/2025 Severity High CVE-2024-10646Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.2.6 - Unauthenticated Stored Cross-Site Scripting via Form Subject Exploitation status Not known exploited Fix Affected product F Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder Published 12/14/2024 Severity High CVE-2024-9511FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider <= 2.2.82 - Unauthenticated PHP Object Injection Exploitation status Not known exploited Fix Affected product F FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider Published 11/23/2024 Severity Critical CVE-2024-9528Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Form Manager+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product F Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder Published 10/05/2024 Severity Medium CVE-2024-5053Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.18 - Missing Authorization to Authenticated (Subscriber+) Mailchimp Integration Modification Exploitation status Not known exploited Fix Affected product F Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder Published 09/01/2024 Severity Medium CVE-2024-7304Ninja Tables – Easiest Data Table Builder <= 5.0.12 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload Exploitation status Not known exploited Fix Affected product N Ninja Tables – Easy Data Table Builder Published 08/27/2024 Severity Medium CVE-2024-6703Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Welcome Screen Fields Exploitation status Not known exploited Fix Affected product F Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder Published 07/27/2024 Severity Medium CVE-2024-6518Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Administrator+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product F Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder Published 07/27/2024 Severity Medium CVE-2024-6520Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Administrator+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product F Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder Published 07/27/2024 Severity Medium CVE-2024-6521Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Administrator+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product F Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder Published 07/27/2024 Severity Medium CVE-2024-4157Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.15 - PHP Object Injection via extractDynamicValues Exploitation status Not known exploited Fix Affected product F Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder Published 05/22/2024 Severity High CVE-2024-4709Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Authenticated (Contributor+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product F Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder Published 05/18/2024 Severity Medium CVE-2024-2772Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product F Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder Published 05/18/2024 Severity Medium CVE-2024-2782Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Missing Authorization to Setting Manipulation Exploitation status Not known exploited Fix Affected product F Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder Published 05/18/2024 Severity High CVE-2024-2771Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Missing Authorization to Settings Update and Limited Privilege Escalation Exploitation status Not known exploited Fix Affected product F Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder Published 05/18/2024 Severity Critical CVE-2023-6957Fluent Forms <= 5.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product F Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder Published 03/13/2024 Severity Medium CVE-2024-0618Fluent Forms <= 5.1.5 - Authenticated(Administrator+) Stored Cross-Site Scripting via imported form title Exploitation status Not known exploited Fix Affected product F Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder Published 01/27/2024 Severity Medium CVE-2023-3087FluentSMTP <= 2.2.4 - Unauthenticated Stored Cross-Site Scripting via Email Subject Exploitation status Not known exploited Fix Affected product F FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider Published 07/12/2023 Severity High CVE-2023-1430FluentCRM - Marketing Automation For WordPress <= 2.8.01 - Insufficient Use of Hash as Authorization Control Exploitation status Not known exploited Fix Affected product F FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution Published 06/09/2023 Severity Medium 
