CVE-2026-2365: Fluent Forms Pro WordPress XSS Vulnerability

CVE-2026-2365 Overview

The Fluent Forms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the fluentform_step_form_save_data AJAX action in all versions up to, and including, 6.1.17. This vulnerability stems from the draft form submission endpoint being publicly accessible without authentication or nonce verification, combined with insufficient input sanitization and output escaping of form field data. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into pages that will execute whenever an administrator views a partial form entry.

Critical Impact

Unauthenticated attackers can inject malicious JavaScript that executes in the context of WordPress administrator sessions, potentially leading to full site compromise, credential theft, or privilege escalation.

Affected Products

• Fluent Forms Pro plugin for WordPress versions up to and including 6.1.17
• WordPress installations with vulnerable Fluent Forms Pro plugin versions

Discovery Timeline

• 2026-03-05 - CVE CVE-2026-2365 published to NVD
• 2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-2365

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability exists in the Fluent Forms Pro plugin's handling of partial form submissions. The vulnerable endpoint fluentform_step_form_save_data allows draft form data to be saved without requiring authentication or nonce verification, which represents a significant security control bypass. When form field data is submitted through this endpoint, it is stored in the database without proper sanitization. Subsequently, when an administrator views the partial form entry through the WordPress admin panel, the stored malicious payload is rendered without adequate output escaping, causing the injected scripts to execute in the administrator's browser context.

The attack is particularly dangerous because it targets administrative users who have elevated privileges within the WordPress installation. A successful exploitation could allow attackers to perform actions with administrator-level permissions, including creating new admin accounts, modifying site content, installing malicious plugins, or exfiltrating sensitive data.

Root Cause

The root cause of this vulnerability is a combination of three security failures:

1. Missing Authentication: The fluentform_step_form_save_data AJAX endpoint is publicly accessible without requiring user authentication
2. Missing Nonce Verification: The endpoint does not verify WordPress nonce tokens, bypassing CSRF protections
3. Insufficient Input Sanitization and Output Escaping: Form field data is not properly sanitized upon storage, and output escaping is inadequate when rendering the data in the admin interface

The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting.

Attack Vector

The attack is conducted over the network and requires no prior authentication or user interaction to inject the payload. An attacker can craft a malicious HTTP request to the vulnerable AJAX endpoint containing JavaScript code within form field values. Since the endpoint requires no authentication, the attacker can submit this payload anonymously.

The exploitation flow involves:

1. Attacker identifies a WordPress site using a vulnerable version of Fluent Forms Pro
2. Attacker crafts a POST request to the fluentform_step_form_save_data AJAX action with malicious JavaScript embedded in form field data
3. The malicious payload is stored in the database as a partial form submission
4. When an administrator accesses the form entries or partial submissions area, the stored XSS payload executes in their browser
5. The malicious script runs with the administrator's session context, enabling various attack scenarios

The vulnerability mechanism involves improper handling of user-supplied input in the form data parsing functionality. For technical details regarding the vulnerable code path, refer to the WordPress Plugin Source Code and the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-2365

Indicators of Compromise

• Unusual or suspicious partial form entries containing script tags, event handlers (e.g., onerror, onload), or JavaScript code
• HTTP requests to the admin-ajax.php endpoint with action=fluentform_step_form_save_data from external or unexpected IP addresses
• Unexpected administrator account creations or privilege changes following admin access to form entries
• JavaScript errors or unexpected behavior when administrators view form submissions

Detection Strategies

• Monitor web server access logs for POST requests to admin-ajax.php containing the fluentform_step_form_save_data action parameter
• Implement Web Application Firewall (WAF) rules to detect and block requests containing common XSS patterns targeting AJAX endpoints
• Deploy endpoint detection solutions to identify unusual JavaScript execution patterns in administrator browser sessions
• Regularly audit form submission data for suspicious content including script tags, encoded JavaScript, or HTML event attributes

Monitoring Recommendations

• Enable detailed logging for WordPress AJAX requests, particularly focusing on unauthenticated requests
• Set up alerting for high volumes of form draft submissions from single IP addresses or unusual geographic locations
• Monitor administrator sessions for signs of session hijacking or unauthorized actions following form entry review
• Implement Content Security Policy (CSP) headers to provide defense-in-depth against script execution

How to Mitigate CVE-2026-2365

Immediate Actions Required

• Update Fluent Forms Pro plugin to a version newer than 6.1.17 that contains the security fix
• Review existing partial form submissions for potentially malicious content and remove any suspicious entries
• Audit WordPress user accounts for any unauthorized additions or privilege escalations
• Consider temporarily disabling the Fluent Forms Pro plugin if an immediate update is not possible

Patch Information

The vulnerability affects Fluent Forms Pro plugin versions up to and including 6.1.17. Administrators should update to the latest patched version immediately. Consult the Fluent Forms Changelog for information about security updates and version history. The Wordfence Vulnerability Report provides additional details about the vulnerability and remediation guidance.

Workarounds

• If immediate patching is not possible, restrict access to the WordPress admin AJAX endpoint for unauthenticated users at the web server level
• Implement a Web Application Firewall rule to block requests to admin-ajax.php containing the fluentform_step_form_save_data action from unauthenticated sources
• Temporarily disable the partial form save functionality if your forms don't require multi-step draft saving
• Add Content Security Policy headers to reduce the impact of any successful XSS attacks

# Apache .htaccess workaround to restrict AJAX endpoint access
# Add to WordPress root .htaccess file (temporary measure only)
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_METHOD} POST
RewriteCond %{REQUEST_URI} /wp-admin/admin-ajax\.php [NC]
RewriteCond %{QUERY_STRING} action=fluentform_step_form_save_data [NC,OR]
RewriteCond %{HTTP:Content-Type} fluentform_step_form_save_data [NC]
RewriteRule .* - [F,L]
</IfModule>