CVE-2026-103343: WordPress FluentForm plugin <= 6.2.14 - Cross Site Scripting (XSS) vulnerability

Q: What level of access does an attacker need to exploit this issue?

The attack vector indicates that an attacker needs low-level privileges in FluentForm or the affected WordPress environment. Exploitation also requires user interaction.

Q: Can this be exploited remotely?

Yes. The vulnerability is rated with a network attack vector and low attack complexity, so exploitation can be attempted over the network by an attacker with the required low privileges.

Q: How can I determine whether an installation is affected?

An installation is affected if it uses WP ManageNinja FluentForm version 6.2.14 or an earlier affected version. The provided data identifies the affected range as through 6.2.14.

Published Oct 1, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP ManageNinja LLC FluentForm fluentform allows Stored XSS.This issue affects FluentForm: from n/a through 6.2.14.

Affected Software

1 affected component

WP ManageNinja FluentForm<=6.2.14

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress FluentForm plugin to a version that resolves this vulnerability.
Fixed in 6.2.15

Event History

Oct 1, 2026

CVE Published

via MITRE·12:27 PM

Data Sourced

via MITRE·12:27 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The attack vector indicates that an attacker needs low-level privileges in FluentForm or the affected WordPress environment. Exploitation also requires user interaction.

Can this be exploited remotely?

Yes. The vulnerability is rated with a network attack vector and low attack complexity, so exploitation can be attempted over the network by an attacker with the required low privileges.

How can I determine whether an installation is affected?

An installation is affected if it uses WP ManageNinja FluentForm version 6.2.14 or an earlier affected version. The provided data identifies the affected range as through 6.2.14.

CVE-2026-103343: WordPress FluentForm plugin <= 6.2.14 - Cross Site Scripting (XSS) vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

Can this be exploited remotely?

How can I determine whether an installation is affected?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

Can this be exploited remotely?

How can I determine whether an installation is affected?