CVE-2026-101324: Fluent Forms WordPress Plugin XSS Vulnerability

CVE-2026-101324 Overview

The Fluent Forms plugin for WordPress contains a Reflected Cross-Site Scripting (XSS) vulnerability affecting all versions up to and including 6.2.14. The flaw stems from insufficient input sanitization and output escaping when the plugin processes {get.NAME} SmartCode placeholders inside URL-accepting HTML attributes such as iframe src or a href. Unauthenticated attackers can inject arbitrary web scripts that execute in a victim's browser when the victim clicks a crafted link. Exploitation requires a site administrator to have configured a Custom HTML field on a published form containing a {get.*} SmartCode inside a URL-accepting attribute, which is a documented Fluent Forms feature. The weakness is classified as [CWE-79].

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in the browsers of users who click crafted links to vulnerable Fluent Forms pages, enabling session theft, credential harvesting, and administrative action abuse.

Affected Products

Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress
All versions up to and including 6.2.14
WordPress sites with Custom HTML form fields using {get.*} SmartCodes inside URL attributes

Discovery Timeline

2026-10-10 - CVE-2026-101324 published to the National Vulnerability Database (NVD)
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-101324

Vulnerability Analysis

Fluent Forms exposes a SmartCode templating syntax that lets form designers embed dynamic values at render time. The {get.NAME} placeholder resolves to a value pulled from the HTTP GET query string parameter named NAME. When an administrator places such a placeholder inside a URL-accepting attribute of a Custom HTML field, for example an iframe src or an anchor href, the resolved value is written into the rendered page without adequate contextual escaping. An attacker who crafts a URL supplying their own value for that query parameter can break out of the attribute context and inject executable script. The attack is reflected and requires user interaction, so a victim must click an attacker-supplied link pointing to the form page.

Root Cause

The root cause is missing output escaping in the SmartCode substitution path for URL contexts. Relevant code paths include the component renderer in app/Modules/Component/Component.php, the Custom HTML component in app/Services/FormBuilder/Components/CustomHtml.php, and the shortcode substitution logic in app/Services/FormBuilder/EditorShortcodeParser.php. Values returned from the GET superglobal through helpers in boot/globals.php are interpolated into HTML attribute values without escaping for URL or JavaScript contexts, allowing attribute-breaking payloads.

Attack Vector

The attack is network-based and unauthenticated but requires user interaction and a specific administrator configuration. An attacker crafts a URL to a page hosting a vulnerable Fluent Forms form, supplying a malicious value for the GET parameter referenced by the {get.NAME} SmartCode. When a victim loads the link, the plugin substitutes the attacker payload inside the URL-accepting attribute, producing an injected javascript: URI or an event-handler attribute that executes script. See the Wordfence Vulnerability Report and the FluentForm Shortcode Parser Code for the vulnerable substitution logic.

// No verified exploitation code is available. Refer to the vendor changeset
// at https://plugins.trac.wordpress.org/changeset/3721107/ for fix details.

Detection Methods for CVE-2026-101324

Indicators of Compromise

Web server access logs showing GET requests to pages hosting Fluent Forms with query parameters containing HTML characters such as ", <, >, or javascript:.
Requests whose query parameter names match placeholders used in form Custom HTML fields and whose values include script fragments or attribute-breaking sequences.
Referrers originating from external sites, phishing lures, or shortened URLs that resolve to form pages with suspicious query strings.

Detection Strategies

Inventory all Fluent Forms Custom HTML fields and flag any that embed {get.*} SmartCodes inside href, src, action, or similar URL-accepting attributes.
Deploy Web Application Firewall (WAF) rules that reject GET parameters containing javascript:, data:text/html, or event-handler patterns such as onerror= when destined for Fluent Forms pages.
Monitor for anomalous spikes in traffic to form-hosting pages with long or encoded query strings.

Monitoring Recommendations

Enable verbose HTTP request logging on the WordPress host and forward logs to a central analytics platform for query-string inspection.
Alert on repeated requests from a single source carrying encoded script payloads to pages known to host Fluent Forms.
Review browser-side Content Security Policy (CSP) violation reports for inline script executions originating from form pages.

How to Mitigate CVE-2026-101324

Immediate Actions Required

Upgrade the Fluent Forms plugin to the version that includes FluentForm Changeset 3721107, which contains the sanitization fix.
Audit every published form for Custom HTML fields and remove or rewrite any {get.*} SmartCode placed inside a URL-accepting attribute until the patch is applied.
Enforce a strict Content Security Policy that disallows inline scripts and restricts javascript: URIs on pages hosting forms.

Patch Information

The vendor addressed the issue in a release following 6.2.14. The remediation modifies the Custom HTML and SmartCode substitution logic in app/Modules/Component/Component.php to apply contextual escaping to values resolved from GET parameters. Review the FluentForm Component Code and the corresponding vendor changeset for the exact code changes.

Workarounds

Remove {get.*} SmartCodes from any Custom HTML field that writes into href, src, or other URL-accepting attributes.
Place a WAF rule in front of form pages that blocks GET parameters containing HTML-breaking characters or javascript: schemes.
Restrict administrator access to form editing so unreviewed templates cannot introduce vulnerable SmartCode usage.

bash

# Example WAF rule concept (ModSecurity) — blocks suspicious query values on form pages
SecRule REQUEST_URI "@contains /fluent-form" \
  "chain,phase:2,deny,status:403,id:1026101324,msg:'Fluent Forms XSS payload blocked'"
SecRule ARGS "@rx (?i)(javascript:|<script|on[a-z]+\s*=)" "t:none,t:urlDecodeUni"