Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-11880

Fluent Forms < 6.2.1 - Subscriber+ Subscription Cancellation via IDOR

The Fluent Forms WordPress plugin before 6.2.1 does not properly verify ownership before processing a subscription cancellation request, allowing authenticated users with a low-privilege account to cancel subscriptions belonging to other users.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Fluent Forms Wordpress
Products
Fluent Forms Wordpress
CVE-2026-11881

Fluent Forms < 6.2.6 - Contributor+ Stored XSS via Date/Time Field

The Fluent Forms WordPress plugin before 6.2.6 does not sanitise and escape one of its form field configuration settings before outputting it inside an inline script when a form is rendered, which could allow users with a role as low as Contributor (with delegated form-management permission, and therefore lacking the unfiltered_html capability, e.g. in a multisite setup) to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor who loads the form, including administrators previewing it.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Fluent Forms Wordpress
Products
Fluent Forms Wordpress