Stored Cross-Site Scripting in Fluent Forms AI Form Builder

Fluent Forms up to 6.1.14 leaks the plugin’s admin AJAX nonce to every logged-in user on form preview pages, and the AI Form Builder endpoint only validated that nonce instead of checking a capability. A Subscriber-level attacker can therefore drive AI form generation and have the returned bare JavaScript stored as the form’s custom JS, which then executes for every visitor who views the generated form.

This vulnerability affects the following application versions:

• Fluent Forms – Customizable Contact Forms 5.0.0
• Fluent Forms – Customizable Contact Forms 5.0.1
• Fluent Forms – Customizable Contact Forms 5.0.2
• Fluent Forms – Customizable Contact Forms 5.0.3
• Fluent Forms – Customizable Contact Forms 5.0.4
• Fluent Forms – Customizable Contact Forms 5.0.5
• Fluent Forms – Customizable Contact Forms 5.0.6
• Fluent Forms – Customizable Contact Forms 5.0.7
• Fluent Forms – Customizable Contact Forms 5.0.8
• Fluent Forms – Customizable Contact Forms 5.0.9
• Fluent Forms – Customizable Contact Forms 5.0.10
• Fluent Forms – Customizable Contact Forms 5.0.11
• Fluent Forms – Customizable Contact Forms 5.0.12
• Fluent Forms – Customizable Contact Forms 5.1.0
• Fluent Forms – Customizable Contact Forms 5.1.1
• Fluent Forms – Customizable Contact Forms 5.1.2
• Fluent Forms – Customizable Contact Forms 5.1.3
• Fluent Forms – Customizable Contact Forms 5.1.4
• Fluent Forms – Customizable Contact Forms 5.1.5
• Fluent Forms – Customizable Contact Forms 5.1.7
• Fluent Forms – Customizable Contact Forms 5.1.8
• Fluent Forms – Customizable Contact Forms 5.1.9
• Fluent Forms – Customizable Contact Forms 5.1.10
• Fluent Forms – Customizable Contact Forms 5.1.11
• Fluent Forms – Customizable Contact Forms 5.1.12
• Fluent Forms – Customizable Contact Forms 5.1.13
• Fluent Forms – Customizable Contact Forms 5.1.14
• Fluent Forms – Customizable Contact Forms 5.1.15
• Fluent Forms – Customizable Contact Forms 5.1.16
• Fluent Forms – Customizable Contact Forms 5.1.17
• Fluent Forms – Customizable Contact Forms 5.1.18
• Fluent Forms – Customizable Contact Forms 5.1.19
• Fluent Forms – Customizable Contact Forms 5.1.20
• Fluent Forms – Customizable Contact Forms 5.2.0
• Fluent Forms – Customizable Contact Forms 5.2.1
• Fluent Forms – Customizable Contact Forms 5.2.2
• Fluent Forms – Customizable Contact Forms 5.2.3
• Fluent Forms – Customizable Contact Forms 5.2.4
• Fluent Forms – Customizable Contact Forms 5.2.5
• Fluent Forms – Customizable Contact Forms 5.2.6
• Fluent Forms – Customizable Contact Forms 5.2.7
• Fluent Forms – Customizable Contact Forms 5.2.8
• Fluent Forms – Customizable Contact Forms 5.2.9
• Fluent Forms – Customizable Contact Forms 5.2.10
• Fluent Forms – Customizable Contact Forms 5.2.11
• Fluent Forms – Customizable Contact Forms 5.2.12
• Fluent Forms – Customizable Contact Forms 6.0.0
• Fluent Forms – Customizable Contact Forms 6.0.1
• Fluent Forms – Customizable Contact Forms 6.0.2
• Fluent Forms – Customizable Contact Forms 6.0.3
• Fluent Forms – Customizable Contact Forms 6.0.4
• Fluent Forms – Customizable Contact Forms 6.1.0
• Fluent Forms – Customizable Contact Forms 6.1.1
• Fluent Forms – Customizable Contact Forms 6.1.2
• Fluent Forms – Customizable Contact Forms 6.1.3
• Fluent Forms – Customizable Contact Forms 6.1.4
• Fluent Forms – Customizable Contact Forms 6.1.5
• Fluent Forms – Customizable Contact Forms 6.1.6
• Fluent Forms – Customizable Contact Forms 6.1.7
• Fluent Forms – Customizable Contact Forms 6.1.8
• Fluent Forms – Customizable Contact Forms 6.1.9
• Fluent Forms – Customizable Contact Forms 6.1.10
• Fluent Forms – Customizable Contact Forms 6.1.11
• Fluent Forms – Customizable Contact Forms 6.1.12
• Fluent Forms – Customizable Contact Forms 6.1.13
• Fluent Forms – Customizable Contact Forms 6.1.14