The Fluent Forms plugin for WordPress contains a stored cross-site scripting flaw in its AI Form Builder module. The vulnerability arises from missing authorization checks, a leaked nonce, and inadequate input sanitization, allowing authenticated users with Subscriber role or higher to trigger an AI form generation endpoint that returns raw JavaScript. Since the plugin fails to escape the response, the resulting script is stored and executed whenever any visitor loads the form, giving attackers the ability to run arbitrary code in the context of all site users.

All installations of techjewel’s Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin built up to and including version 6.1.14 are affected. Any WordPress site that incorporates this plugin and grants Subscriber or higher access can be impacted.

The CVSS score of 6.4 indicates medium severity, while the EPSS score below 1% suggests a very low likelihood of exploitation. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. An attacker only needs authenticated access at the Subscriber level or higher. After exploiting the flaw, the injected JavaScript runs for every user who views the compromised form, potentially leading to session hijacking, data theft, or defacement.