The vulnerability in the Fluent Forms WordPress plugin allows attackers to inject arbitrary JavaScript through the "param" query string because the input is not adequately sanitized and the output is not properly escaped. This is a classic reflected XSS flaw (CWE‑79) that can be triggered by any user who clicks on a crafted link. If successful, the injected script executes in the victim's browser, potentially allowing cookie theft, session hijack, or other client‑side attacks. The flaw is present in all versions up to and including 6.2.8 and requires no authentication, affecting the confidentiality, integrity, and availability of any user interacting with the vulnerable form pages.

The affected product is the Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress. Versions 6.2.8 and earlier are vulnerable; upgrades to 6.2.9 or later contain the fix.

The CVSS score of 6.1 indicates a medium severity vulnerability. The EPSS score of less than 1% means that exploit activity is currently rare, and the vulnerability is not listed in the CISA KEV catalog. An attacker would need to entice a user to click on a maliciously crafted link, so while the risk is notable, the practical exploitation window is limited. Nonetheless, the flaw provides a straightforward vector for cross‑site attacks, warranting prompt remediation.