tadrik Free store check

Plugin security / Fluent Forms

Fluent Forms vulnerability: is your WooCommerce store affected?

Fluent Forms has 10 serious security holes rated 7 or higher out of 10 that someone can use with no login or with only a customer account. The newest was published on 31 July 2026. Every one is fixed: update to 6.2.12 or newer.

Short answer: your store is affected if it runs Fluent Forms older than 6.2.12. Update to 6.2.12 or newer, on a copy of the store first if you can.

In our check of 3,600 live UK and US WooCommerce stores (31 October 2026 to 1 November 2026), 10 were running a version of Fluent Forms with a serious hole that already had a fix. How we checked.

The security holes

Newest first. Each one is published in a public security database and fixed in the version shown.

  1. Cross-site scripting

    Someone could plant a script that runs in your visitors' or your admins' browsers.

    Score 7.2 (high)no login neededAffected: older than 6.2.12Fixed in 6.2.12Published 31 July 2026CVE-2026-18146

    Advisory: The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Notification Smartcode Values in all versions up to,...

  2. Cross-site scripting

    Someone could plant a script that runs in your visitors' or your admins' browsers.

    Score 7.2 (high)no login neededAffected: older than 6.2.8Fixed in 6.2.8Published 28 July 2026CVE-2026-16655

    Advisory: The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Name Field Nested `password` Member in all versions up...

  3. Missing permission check

    An action that should need permission could be done without it.

    Score 8.2 (high)no login neededAffected: older than 6.2.0Fixed in 6.2.0Published 13 May 2026CVE-2026-5396

    Advisory: The Fluent Forms plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to, and including, 6.1.21.

  4. Missing permission check

    An action that should need permission could be done without it.

    Score 8.2 (high)no login neededAffected: older than 6.2.1Fixed in 6.2.1Published 13 May 2026CVE-2026-5395

    Advisory: The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.2.0 via the...

  5. Cross-site scripting

    Someone could plant a script that runs in your visitors' or your admins' browsers.

    Score 7.2 (high)no login neededAffected: older than 5.2.7Fixed in 5.2.7Published 13 December 2024CVE-2024-10646

    Advisory: The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form's subject parameter in all versions up to, and...

  6. PHP object injection

    In some setups, someone could make your server run code.

    Score 8.8 (high)needs only a customer accountAffected: older than 5.1.16Fixed in 5.1.16Published 21 May 2024CVE-2024-4157

    Advisory: The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.1.15 via deserialization of...

  7. Privilege escalation

    A user could give themselves more rights, up to full admin.

    Score 9.8 (critical)no login neededAffected: older than 5.1.17Fixed in 5.1.17Published 17 May 2024CVE-2024-2771

    Advisory: The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the...

  8. Missing permission check

    An action that should need permission could be done without it.

    Score 7.5 (high)no login neededAffected: older than 5.1.17Fixed in 5.1.17Published 17 May 2024CVE-2024-2782

    Advisory: The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the...

2 older holes, published before 1 January 2023

  1. Spreadsheet formula injection

    A spreadsheet exported from the store could run a harmful formula when someone opens it.

    Score 9.8 (critical)no login neededAffected: older than 4.3.13Fixed in 4.3.13Published 17 October 2022d1f1cc7d5244179f9854d89d56d94fe1b7313d5c

    Advisory: CSV Injection vulnerability discovered by Francesco Carlucci in WordPress FluentForm plugin (versions <= 4.3.12).

  2. Privilege escalation

    A user could give themselves more rights, up to full admin.

    Score 8.8 (high)no login neededAffected: older than 3.6.67Fixed in 3.6.67Published 16 June 2021CVE-2021-34620

    Advisory: The WP Fluent Forms plugin < 3.6.67 for WordPress is vulnerable to Cross-Site Request Forgery leading to stored Cross-Site Scripting and limited Privilege Escalation due to a missing nonce check in the access control...

How to check your version

  1. Log in to WordPress and open Plugins > Installed Plugins.
  2. Find Fluent Forms. The version number is under its name. If it is lower than 6.2.12, your store is affected.
  3. No login to hand? Open https://yourstore.com/wp-content/plugins/fluentform/readme.txt in a browser, with your own address in place of yourstore.com, and read the Stable tag line. Some hosts block this file; then use step 1.

How to fix it

  1. Make a backup, or better, a staging copy of the store (most hosts have a one-click staging button).
  2. On the copy, update Fluent Forms to 6.2.12 or newer: Dashboard > Updates, or Update now on the Plugins page.
  3. If no update shows, it may be a paid version whose licence has run out: download the new version from the seller's site and upload it.
  4. Place a test order on the copy: add to cart, check out, pay with a test method. Check the pages that use Fluent Forms.
  5. If everything works, make the same update on the live store and place one more test order.
  6. If you no longer use Fluent Forms, delete it instead of leaving it deactivated.

Not sure, or no time?

Get a free check of your store: we look at its public pages for plugins with known holes, and reply within one working day. Or we fix it for you: we update your store on a copy, place a test order, and only then change the live store, for a fixed £99 / $119.

Free store check Fix it for me on a copy

Questions

Which Fluent Forms version fixes it?
Version 6.2.12 or newer fixes all 10 issues on this page.
How do I know if my store is affected?
Your store is affected if it runs Fluent Forms older than 6.2.12. In WordPress, open Plugins and read the version under Fluent Forms. Without logging in, open yourstore.com/wp-content/plugins/fluentform/readme.txt and read the Stable tag line.
I don't use Fluent Forms any more. Is a deactivated copy safe?
Deactivating it lowers the risk but leaves the old code on your server. If you don't use it, delete it; if you do, update it.
Can someone fix it for me?
Yes. We update the store on a copy first, place a test order, and only then make the same change on the live store, for a fixed price.

Vulnerability data: WPVulnerability (wpvulnerability.net, CC0), which links each entry to its CVE or advisory. Store numbers: Tadrik's own checks of public pages, aggregates only. Page updated 3 November 2026.