CVE-2026-16655 Overview
CVE-2026-16655 is a Stored Cross-Site Scripting (XSS) vulnerability in the Fluent Forms plugin for WordPress, affecting all versions up to and including 6.2.7. The flaw exists in the handling of the Name Field's nested password member, where insufficient input sanitization and output escaping allow attackers to inject arbitrary web scripts. Unauthenticated attackers can submit malicious payloads through form fields that later execute in the browser context of any user who views an affected page. The issue is tracked under [CWE-79] and has been fixed in Fluent Forms version 6.2.8.
Critical Impact
Unauthenticated attackers can inject persistent JavaScript that executes in administrator and visitor browsers, enabling session theft, account takeover, and further compromise of the WordPress site.
Affected Products
- Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress
- All versions up to and including 6.2.7
- Fixed in version 6.2.8
Discovery Timeline
- 2026-07-29 - CVE-2026-16655 published to the National Vulnerability Database (NVD)
- 2026-07-30 - Last updated in the NVD database
Technical Details for CVE-2026-16655
Vulnerability Analysis
The vulnerability resides in the way Fluent Forms processes submissions containing a Name Field with a nested password member. Form submissions flow through several components including app/Hooks/Ajax.php, app/Modules/Form/FormDataParser.php, app/Modules/SubmissionHandler/SubmissionHandler.php, and app/Services/Form/SubmissionHandlerService.php. The plugin fails to sanitize the nested password value on input and does not escape it on output, allowing script content to persist in stored submissions and render as executable markup when rendered back to the page.
Because the vulnerable endpoint is reachable via the standard AJAX submission hook, exploitation does not require authentication. The stored payload later executes whenever a user, such as a site administrator viewing submission notifications or a visitor accessing an affected page, loads the injected content.
Root Cause
The root cause is a combination of missing input sanitization in the form data parser and missing output escaping in the notification and rendering layers, specifically around nested member fields such as password inside the Name Field structure. The parser at FormDataParser.php#L317 and the notification service at GlobalNotificationService.php#L59 propagate attacker-controlled values without applying context-appropriate encoding.
Attack Vector
An unauthenticated remote attacker submits a crafted form entry through the public-facing Fluent Forms submission endpoint. The attacker places a JavaScript payload inside the nested password member of the Name Field. The payload is stored in the site's database as part of the submission and executed later in the browser of any user who views the injected content. Because the scope is changed, the injected script can act on behalf of privileged users viewing submission dashboards or notification content.
No verified proof-of-concept code is available at this time. Refer to the Wordfence Vulnerability Report and the WordPress FluentForm Changeset 3619584 for technical details on the vulnerable code paths and the fix.
Detection Methods for CVE-2026-16655
Indicators of Compromise
- Form submission records in the fluentform_submissions database table containing HTML tags such as <script>, onerror=, onload=, or javascript: URIs within Name Field values
- Outbound requests from administrator browsers to unfamiliar domains shortly after viewing the Fluent Forms admin dashboard
- New or unexpected WordPress administrator accounts created following visits to submission pages
- Web server access logs showing POST requests to the Fluent Forms AJAX endpoint containing encoded script payloads in nested password parameters
Detection Strategies
- Query the WordPress database for stored submissions containing script tags, event handlers, or JavaScript URI schemes in Name Field data
- Deploy web application firewall rules that inspect POST bodies to Fluent Forms endpoints for XSS payloads in nested form members
- Enable a strict Content Security Policy (CSP) and monitor Content-Security-Policy-Report-Only violations for inline script executions in the WordPress admin area
Monitoring Recommendations
- Alert on any Fluent Forms plugin version below 6.2.8 reported by WordPress site inventory scans
- Monitor WordPress admin session activity for anomalous actions occurring immediately after loading submission or notification pages
- Track file modifications under wp-content/plugins/fluentform/ to identify tampering or attempts to disable the patched sanitization logic
How to Mitigate CVE-2026-16655
Immediate Actions Required
- Update the Fluent Forms plugin to version 6.2.8 or later on all WordPress installations
- Audit existing form submissions for stored payloads and purge any entries containing script content before administrators view them
- Rotate WordPress administrator credentials and invalidate active sessions if signs of exploitation are present
- Enable a Web Application Firewall (WAF) with XSS filtering in front of WordPress sites running Fluent Forms
Patch Information
The vendor fixed the vulnerability in Fluent Forms version 6.2.8. The fix is captured in WordPress FluentForm Changeset 3619584 and the version diff between 6.2.7 and 6.2.8. Administrators should apply the update through the WordPress plugin manager or via WP-CLI as soon as possible.
Workarounds
- If patching is not immediately possible, disable the Fluent Forms plugin until the update can be applied
- Restrict access to WordPress admin pages that render Fluent Forms submissions to trusted IP ranges
- Deploy a strict Content Security Policy that blocks inline scripts and unauthorized script sources in the WordPress admin interface
- Configure WAF rules to reject form submissions containing HTML tags or JavaScript URI schemes in Name Field parameters
# Update Fluent Forms to the patched version using WP-CLI
wp plugin update fluentform --version=6.2.8
# Verify the installed version
wp plugin get fluentform --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
