CVE-2026-18146 Overview
CVE-2026-18146 is a Stored Cross-Site Scripting (XSS) vulnerability in the Fluent Forms WordPress plugin, affecting all versions up to and including 6.2.11. The flaw stems from insufficient input sanitization and output escaping when processing Notification Smartcode values. Unauthenticated attackers can inject arbitrary JavaScript that executes in the browser of any administrator or user with the Fluent Forms entry-viewing capability when they view Submission Logs in the WordPress admin dashboard. Exploitation is conditional: a site administrator or Fluent Forms manager must have configured an email notification whose subject or static Send To value references an attacker-influenced Smartcode such as input_password, a cookie value, or submission.response.
Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in the admin context, enabling session hijacking, privilege escalation, or persistent backdoor installation across WordPress sites running vulnerable Fluent Forms versions.
Affected Products
- Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress
- All versions up to and including 6.2.11
- Fixed in Fluent Forms version 6.2.12
Discovery Timeline
- 2026-08-13 - CVE-2026-18146 published to NVD
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-18146
Vulnerability Analysis
The vulnerability [CWE-79] resides in how Fluent Forms processes Smartcode placeholders during email notification handling and Submission Log rendering. The plugin's ShortCodeParser resolves Smartcode tokens against submission data, cookies, and other runtime values without escaping the resolved output. When the resolved value contains HTML or JavaScript payloads supplied by an unauthenticated form submitter, the payload is stored and later rendered in the admin dashboard's Submission Logs view.
Relevant plugin source paths include the notification handler at app/Services/FormBuilder/Notifications/EmailNotification.php and the Smartcode resolution logic at app/Services/FormBuilder/ShortCodeParser.php. The Submission Logs interface driven by assets/js/form_entries.js renders the stored notification metadata without sufficient client-side escaping, completing the stored XSS chain.
Root Cause
The root cause is missing output escaping on Smartcode-resolved values used in notification subjects and static Send To fields. Smartcodes such as {inputs.input_password}, cookie references, and {submission.response} accept attacker-controlled data from the public form submission. The parser inserts these values into stored notification records without HTML-encoding, and the admin-side Submission Logs view later displays them as raw markup.
Attack Vector
An unauthenticated attacker submits a public Fluent Forms form containing a JavaScript payload in a field referenced by a Smartcode in the notification configuration. Common triggers include a password-type input rendered via {inputs.input_password} or values captured via cookie or full submission response Smartcodes. When an administrator opens the entry's Submission Logs, the browser parses and executes the injected script under the WordPress admin origin, enabling session theft, arbitrary admin API calls, or creation of new administrator accounts.
A verified proof of concept is not publicly available. For technical implementation details, refer to the WordPress FluentForm ShortCode Parser source and the Wordfence Vulnerability Intelligence entry.
Detection Methods for CVE-2026-18146
Indicators of Compromise
- Fluent Forms entries containing HTML tags such as <script>, <img onerror=, or <svg onload= in submitted field values.
- Unexpected WordPress administrator accounts, changed user roles, or new plugin installations following administrator visits to Submission Logs.
- Outbound requests from admin browser sessions to unrecognized domains shortly after opening the Fluent Forms entries dashboard.
Detection Strategies
- Query the Fluent Forms submissions and notification log tables for stored values containing script tags or JavaScript event handlers.
- Review WordPress access logs for POST requests to Fluent Forms endpoints containing URL-encoded XSS payloads targeting password or hidden fields.
- Correlate administrator authentication events with subsequent privileged actions such as user creation via wp-admin/user-new.php originating from the same session.
Monitoring Recommendations
- Monitor the WordPress wp_users and wp_usermeta tables for unauthorized role escalations to administrator.
- Alert on modifications to core plugin and theme files following admin dashboard activity involving Fluent Forms.
- Track Fluent Forms plugin version across all managed WordPress sites and flag any host still running 6.2.11 or earlier.
How to Mitigate CVE-2026-18146
Immediate Actions Required
- Upgrade Fluent Forms to version 6.2.12 or later on all WordPress installations.
- Audit notification configurations for any subject or static Send To values referencing user-influenced Smartcodes such as input_password, cookie values, or submission.response.
- Review recent form submissions and Submission Log entries for stored script payloads and purge affected records.
Patch Information
The vendor fix is delivered in Fluent Forms 6.2.12. The corrective changes are captured in Changeset 3640683 and the full version diff from 6.2.11 to 6.2.12. The patch adds output escaping to Smartcode-resolved values used in notification metadata.
Workarounds
- Remove any email notifications whose subject or Send To fields reference Smartcodes resolving to user-supplied input until the patch is applied.
- Restrict the Fluent Forms entry-viewing capability to a minimal set of trusted administrator accounts.
- Deploy a web application firewall rule to block form submissions containing HTML tags or JavaScript event handlers in Fluent Forms field values.
# Configuration example: verify installed Fluent Forms version via WP-CLI
wp plugin get fluentform --field=version
# Force upgrade to the patched release
wp plugin update fluentform --version=6.2.12
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
