The flaw in the Fluent Forms plugin allows an attacker to inject malicious script code into the 'Name' field that contains a nested 'password' element. Because the input is not properly sanitized or escaped before being stored, the script becomes permanently embedded in the form data and will execute in any browser that loads a page containing the compromised form entry. Based on the description, it is inferred that such stored cross‑site scripting could lead to session hijacking, credential theft, defacement, or execution of arbitrary client‑side code against site visitors.

WordPress sites running wpmanageninja:Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder versions up to and including 6.2.7 are affected.

The CVSS score of 7.2 indicates a high severity vulnerability, while the EPSS score of less than 1% suggests that real‑world exploitation is currently rare but possible. The vulnerability is not listed in CISA’s KEV catalog. A likely attack vector is an unauthenticated actor submitting a crafted form entry; the malicious script is stored and subsequently rendered for any user who views the form, making it a purely client‑side impact but capable of compromising the session cookies of unsuspecting visitors.