CVE-2026-94675: Fluent Forms Pro XSS Vulnerability

CVE-2026-94675 Overview

CVE-2026-94675 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the Fluent Forms Pro Add On Pack plugin for WordPress. The flaw affects all versions up to and including 6.2.13. An unauthenticated attacker can inject malicious script content that executes in the browser of a user who interacts with a crafted request or link. The vulnerability is tracked under CWE-79, Improper Neutralization of Input During Web Page Generation.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in a victim's browser session, enabling session hijacking, credential theft, and redirection to attacker-controlled infrastructure.

Affected Products

Fluent Forms Pro Add On Pack plugin for WordPress
All versions <= 6.2.13
WordPress sites running the vulnerable plugin

Discovery Timeline

2026-10-06 - CVE-2026-94675 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-94675

Vulnerability Analysis

The vulnerability is a reflected or stored Cross-Site Scripting (XSS) issue in the Fluent Forms Pro Add On Pack WordPress plugin. The plugin fails to properly neutralize user-supplied input before including it in web page output. An attacker can craft input containing JavaScript that the plugin renders back to the browser without adequate escaping or sanitization.

Exploitation requires user interaction, consistent with reflected XSS delivery through crafted URLs or form submissions. The scope is changed, meaning the executed script can affect resources beyond the vulnerable component, including the authenticated WordPress session of a visiting administrator or editor.

Successful exploitation yields limited impacts to confidentiality, integrity, and availability within the victim's browser context. Attackers commonly weaponize these conditions to steal session cookies, perform actions as the victim via the WordPress REST API, or deliver secondary payloads.

Root Cause

The root cause is improper input neutralization during web page generation, categorized as CWE-79. The plugin processes attacker-controlled parameters and reflects them into HTML output without context-aware escaping. See the Patchstack advisory for technical details.

Attack Vector

The attack is executed over the network and requires no authentication. The attacker crafts a URL or request containing a malicious payload and lures a victim into visiting it. When the vulnerable plugin renders the response, the injected script executes in the victim's browser under the origin of the WordPress site.

// No verified proof-of-concept has been published.
// Refer to the Patchstack advisory for technical analysis.

Detection Methods for CVE-2026-94675

Indicators of Compromise

Web server access logs containing requests with <script>, javascript:, onerror=, or onload= tokens in query strings or POST bodies targeting Fluent Forms endpoints.
Unexpected outbound requests from administrator browsers to unknown domains following interaction with WordPress pages.
Unauthorized creation of WordPress administrator accounts or modification of user roles immediately after a reflected link click.

Detection Strategies

Inspect WordPress plugin inventory for fluentformpro versions <= 6.2.13 across all managed sites.
Deploy Web Application Firewall (WAF) rules that match common XSS payload patterns on parameters consumed by Fluent Forms Pro Add On Pack handlers.
Correlate browser telemetry with web proxy logs to identify script execution originating from reflected input.

Monitoring Recommendations

Alert on anomalous wp-admin activity, such as new administrator accounts or plugin installations, following external link clicks.
Monitor Content Security Policy (CSP) violation reports for inline script execution on pages served by the plugin.
Track plugin version drift and flag any WordPress site still running Fluent Forms Pro Add On Pack 6.2.13 or earlier.

How to Mitigate CVE-2026-94675

Immediate Actions Required

Update Fluent Forms Pro Add On Pack to a version later than 6.2.13 as soon as the vendor publishes a patched release.
Audit WordPress sites for exposure and temporarily deactivate the plugin where business operations allow.
Rotate session cookies and administrator credentials on any site suspected of exploitation.

Patch Information

Consult the Patchstack vulnerability report for the current patched version and vendor remediation guidance. Apply the fixed release through the WordPress plugin updater once available.

Workarounds

Deploy a WAF ruleset that blocks requests containing XSS payload patterns targeting Fluent Forms endpoints.
Enforce a strict Content Security Policy (CSP) that disallows inline scripts and restricts script sources to trusted origins.
Restrict administrative access to WordPress through IP allowlisting or VPN to limit the pool of high-value victims.

bash

# Example CSP header to reduce XSS impact
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'self'"