CVE-2026-94675: WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.13 - Cross Site Scripting (XSS) vulnerability

Q: Which deployments should be treated as affected?

WordPress sites using Fluent Forms Pro Add On Pack versions 6.2.13 or earlier should be treated as affected.

Q: Does an attacker need an account to exploit this issue?

No. The vulnerability is unauthenticated, so exploitation does not require attacker privileges or a WordPress account. User interaction is required.

Q: What is the expected security impact if exploitation succeeds?

The reported CVSS vector indicates low-impact compromise of confidentiality, integrity, and availability, with scope changed beyond the vulnerable component.

Published Oct 6, 2026

Updated

Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack <= 6.2.13 versions.

Affected Software

1 affected component

Fluent Forms Fluent Forms Pro Add On Pack<=6.2.13

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Fluent Forms Pro Add On Pack to a version that resolves this vulnerability.
Fixed in 6.2.14

Event History

Oct 6, 2026

CVE Published

via MITRE·08:35 AM

Data Sourced

via MITRE·08:35 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·09:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments should be treated as affected?

WordPress sites using Fluent Forms Pro Add On Pack versions 6.2.13 or earlier should be treated as affected.

Does an attacker need an account to exploit this issue?

No. The vulnerability is unauthenticated, so exploitation does not require attacker privileges or a WordPress account. User interaction is required.

What is the expected security impact if exploitation succeeds?

The reported CVSS vector indicates low-impact compromise of confidentiality, integrity, and availability, with scope changed beyond the vulnerable component.

CVE-2026-94675: WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.13 - Cross Site Scripting (XSS) vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments should be treated as affected?

Does an attacker need an account to exploit this issue?

What is the expected security impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Which deployments should be treated as affected?

Does an attacker need an account to exploit this issue?

What is the expected security impact if exploitation succeeds?