Unknown Fluent Forms vulnerabilities

3 CVEs affecting Unknown Fluent Forms, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-11881, published 2026-07-30.

More from Unknown.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-11578, published 2026-07-02. Low severity, CVSS 2.7. EPSS: 0.3% chance of exploitation in the next 30 days. The Fluent Forms WordPress plugin before 6.2.5 does not properly restrict the deletion of form submission entries to the forms a restricted Manager is authorized to manage, allowing a Manager…
• CVE-2026-11881, published 2026-07-30. Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days. The Fluent Forms WordPress plugin before 6.2.6 does not sanitise and escape one of its form field configuration settings before outputting it inside an inline script when a form is rendered, which…
• CVE-2026-11880, published 2026-07-01. Low severity, CVSS 3.1. EPSS: 0.2% chance of exploitation in the next 30 days. The Fluent Forms WordPress plugin before 6.2.1 does not properly verify ownership before processing a subscription cancellation request, allowing authenticated users with a low-privilege account to…