The vulnerability is a stored cross‑site scripting flaw in the form-submission.js script of Fluent Forms up to version 6.0.2. Insufficient input sanitization and output escaping lets users with Contributor or higher role insert malicious scripts that persist in the form. When any visitor loads the page containing the form, the injected scripts execute in the victim’s browser, wherein, based on the description, it is inferred that the attacker could hijack sessions, deface content, or run arbitrary client‑side code. The weakness is identified as CWE‑79.

The affected product is Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder, version 6.0.2 and earlier. The vendor is techjewel. Any user with Contributor or higher role can exploit the flaw.

The CVSS score of 6.4 places the vulnerability in the medium severity range, but the EPSS score is less than 1 % indicating a very low likelihood of exploitation at this time. It is not listed in the CISA KEV catalog, so it has not yet been reported as widely exploited. The attack requires the attacker to be authenticated as a Contributor or better, after which they can embed malicious code through the form administration interface and cause it to execute for all visitors to the affected pages.