Fluent Forms – Customizable Contact Forms

Unauthenticated attackers can store arbitrary JavaScript through Fluent Forms notification smartcode values such as {cookie.*}, which executes in an administrator’s browser when they view the form’s submission logs. The {user.*} smartcode could also expose sensitive user fields such as the password hash. Sites running Fluent Forms 6.2.11 and earlier are affected.

This vulnerability affects the following application versions:

• Fluent Forms – Customizable Contact Forms 3.5.0
• Fluent Forms – Customizable Contact Forms 3.5.1
• Fluent Forms – Customizable Contact Forms 3.5.2
• Fluent Forms – Customizable Contact Forms 3.5.3
• Fluent Forms – Customizable Contact Forms 3.5.4
• Fluent Forms – Customizable Contact Forms 3.5.5
• Fluent Forms – Customizable Contact Forms 3.5.6
• Fluent Forms – Customizable Contact Forms 3.6.0
• Fluent Forms – Customizable Contact Forms 3.6.2
• Fluent Forms – Customizable Contact Forms 3.6.21
• Fluent Forms – Customizable Contact Forms 3.6.22
• Fluent Forms – Customizable Contact Forms 3.6.31
• Fluent Forms – Customizable Contact Forms 3.6.40
• Fluent Forms – Customizable Contact Forms 3.6.41
• Fluent Forms – Customizable Contact Forms 3.6.42
• Fluent Forms – Customizable Contact Forms 3.6.50
• Fluent Forms – Customizable Contact Forms 3.6.51
• Fluent Forms – Customizable Contact Forms 3.6.60
• Fluent Forms – Customizable Contact Forms 3.6.61
• Fluent Forms – Customizable Contact Forms 3.6.62
• Fluent Forms – Customizable Contact Forms 3.6.64
• Fluent Forms – Customizable Contact Forms 3.6.65
• Fluent Forms – Customizable Contact Forms 3.6.66
• Fluent Forms – Customizable Contact Forms 3.6.67
• Fluent Forms – Customizable Contact Forms 3.6.68
• Fluent Forms – Customizable Contact Forms 3.6.69
• Fluent Forms – Customizable Contact Forms 3.6.70
• Fluent Forms – Customizable Contact Forms 3.6.71
• Fluent Forms – Customizable Contact Forms 3.6.72
• Fluent Forms – Customizable Contact Forms 3.6.73
• Fluent Forms – Customizable Contact Forms 3.6.74
• Fluent Forms – Customizable Contact Forms 4.0.0
• Fluent Forms – Customizable Contact Forms 4.0.1
• Fluent Forms – Customizable Contact Forms 4.1.0
• Fluent Forms – Customizable Contact Forms 4.1.5
• Fluent Forms – Customizable Contact Forms 4.1.51
• Fluent Forms – Customizable Contact Forms 4.2.0
• Fluent Forms – Customizable Contact Forms 4.2.1
• Fluent Forms – Customizable Contact Forms 4.3.0
• Fluent Forms – Customizable Contact Forms 4.3.1
• Fluent Forms – Customizable Contact Forms 4.3.2
• Fluent Forms – Customizable Contact Forms 4.3.3
• Fluent Forms – Customizable Contact Forms 4.3.4
• Fluent Forms – Customizable Contact Forms 4.3.5
• Fluent Forms – Customizable Contact Forms 4.3.6
• Fluent Forms – Customizable Contact Forms 4.3.7
• Fluent Forms – Customizable Contact Forms 4.3.8
• Fluent Forms – Customizable Contact Forms 4.3.9
• Fluent Forms – Customizable Contact Forms 4.3.10
• Fluent Forms – Customizable Contact Forms 4.3.11
• Fluent Forms – Customizable Contact Forms 4.3.12
• Fluent Forms – Customizable Contact Forms 4.3.13
• Fluent Forms – Customizable Contact Forms 4.3.14
• Fluent Forms – Customizable Contact Forms 4.3.15
• Fluent Forms – Customizable Contact Forms 4.3.16
• Fluent Forms – Customizable Contact Forms 4.3.17
• Fluent Forms – Customizable Contact Forms 4.3.18
• Fluent Forms – Customizable Contact Forms 4.3.19
• Fluent Forms – Customizable Contact Forms 4.3.20
• Fluent Forms – Customizable Contact Forms 4.3.21
• Fluent Forms – Customizable Contact Forms 4.3.22
• Fluent Forms – Customizable Contact Forms 4.3.23
• Fluent Forms – Customizable Contact Forms 4.3.24
• Fluent Forms – Customizable Contact Forms 4.3.25
• Fluent Forms – Customizable Contact Forms 5.0.0
• Fluent Forms – Customizable Contact Forms 5.0.1
• Fluent Forms – Customizable Contact Forms 5.0.2
• Fluent Forms – Customizable Contact Forms 5.0.3
• Fluent Forms – Customizable Contact Forms 5.0.4
• Fluent Forms – Customizable Contact Forms 5.0.5
• Fluent Forms – Customizable Contact Forms 5.0.6
• Fluent Forms – Customizable Contact Forms 5.0.7
• Fluent Forms – Customizable Contact Forms 5.0.8
• Fluent Forms – Customizable Contact Forms 5.0.9
• Fluent Forms – Customizable Contact Forms 5.0.10
• Fluent Forms – Customizable Contact Forms 5.0.11
• Fluent Forms – Customizable Contact Forms 5.0.12
• Fluent Forms – Customizable Contact Forms 5.1.0
• Fluent Forms – Customizable Contact Forms 5.1.1
• Fluent Forms – Customizable Contact Forms 5.1.2
• Fluent Forms – Customizable Contact Forms 5.1.3
• Fluent Forms – Customizable Contact Forms 5.1.4
• Fluent Forms – Customizable Contact Forms 5.1.5
• Fluent Forms – Customizable Contact Forms 5.1.7
• Fluent Forms – Customizable Contact Forms 5.1.8
• Fluent Forms – Customizable Contact Forms 5.1.9
• Fluent Forms – Customizable Contact Forms 5.1.10
• Fluent Forms – Customizable Contact Forms 5.1.11
• Fluent Forms – Customizable Contact Forms 5.1.12
• Fluent Forms – Customizable Contact Forms 5.1.13
• Fluent Forms – Customizable Contact Forms 5.1.14
• Fluent Forms – Customizable Contact Forms 5.1.15
• Fluent Forms – Customizable Contact Forms 5.1.16
• Fluent Forms – Customizable Contact Forms 5.1.17
• Fluent Forms – Customizable Contact Forms 5.1.18
• Fluent Forms – Customizable Contact Forms 5.1.19
• Fluent Forms – Customizable Contact Forms 5.1.20
• Fluent Forms – Customizable Contact Forms 5.2.0
• Fluent Forms – Customizable Contact Forms 5.2.1
• Fluent Forms – Customizable Contact Forms 5.2.2
• Fluent Forms – Customizable Contact Forms 5.2.3
• Fluent Forms – Customizable Contact Forms 5.2.4
• Fluent Forms – Customizable Contact Forms 5.2.5
• Fluent Forms – Customizable Contact Forms 5.2.6
• Fluent Forms – Customizable Contact Forms 5.2.7
• Fluent Forms – Customizable Contact Forms 5.2.8
• Fluent Forms – Customizable Contact Forms 5.2.9
• Fluent Forms – Customizable Contact Forms 5.2.10
• Fluent Forms – Customizable Contact Forms 5.2.11
• Fluent Forms – Customizable Contact Forms 5.2.12
• Fluent Forms – Customizable Contact Forms 6.0.0
• Fluent Forms – Customizable Contact Forms 6.0.1
• Fluent Forms – Customizable Contact Forms 6.0.2
• Fluent Forms – Customizable Contact Forms 6.0.3
• Fluent Forms – Customizable Contact Forms 6.0.4
• Fluent Forms – Customizable Contact Forms 6.1.0
• Fluent Forms – Customizable Contact Forms 6.1.1
• Fluent Forms – Customizable Contact Forms 6.1.2
• Fluent Forms – Customizable Contact Forms 6.1.3
• Fluent Forms – Customizable Contact Forms 6.1.4
• Fluent Forms – Customizable Contact Forms 6.1.5
• Fluent Forms – Customizable Contact Forms 6.1.6
• Fluent Forms – Customizable Contact Forms 6.1.7
• Fluent Forms – Customizable Contact Forms 6.1.8
• Fluent Forms – Customizable Contact Forms 6.1.9
• Fluent Forms – Customizable Contact Forms 6.1.10
• Fluent Forms – Customizable Contact Forms 6.1.11
• Fluent Forms – Customizable Contact Forms 6.1.12
• Fluent Forms – Customizable Contact Forms 6.1.13
• Fluent Forms – Customizable Contact Forms 6.1.14
• Fluent Forms – Customizable Contact Forms 6.1.15
• Fluent Forms – Customizable Contact Forms 6.1.16
• Fluent Forms – Customizable Contact Forms 6.1.17
• Fluent Forms – Customizable Contact Forms 6.1.18
• Fluent Forms – Customizable Contact Forms 6.1.19
• Fluent Forms – Customizable Contact Forms 6.1.20
• Fluent Forms – Customizable Contact Forms 6.1.21
• Fluent Forms – Customizable Contact Forms 6.2.0
• Fluent Forms – Customizable Contact Forms 6.2.1
• Fluent Forms – Customizable Contact Forms 6.2.2
• Fluent Forms – Customizable Contact Forms 6.2.3
• Fluent Forms – Customizable Contact Forms 6.2.4
• Fluent Forms – Customizable Contact Forms 6.2.5
• Fluent Forms – Customizable Contact Forms 6.2.6
• Fluent Forms – Customizable Contact Forms 6.2.7
• Fluent Forms – Customizable Contact Forms 6.2.8
• Fluent Forms – Customizable Contact Forms 6.2.9
• Fluent Forms – Customizable Contact Forms 6.2.10
• Fluent Forms – Customizable Contact Forms 6.2.11

The Stripe SCA payment confirmation endpoints in Fluent Forms accept a submission_id from the request without verifying that the caller is entitled to act on that submission. An unauthenticated attacker who can guess or enumerate a valid submission identifier can therefore tamper with the payment status of other users’ form submissions, for example marking a pending payment as failed. Sites using Fluent Forms with Stripe payments enabled are affected.

This vulnerability affects the following application versions:

• Fluent Forms – Customizable Contact Forms 6.0.0
• Fluent Forms – Customizable Contact Forms 6.0.1
• Fluent Forms – Customizable Contact Forms 6.0.2
• Fluent Forms – Customizable Contact Forms 6.0.3
• Fluent Forms – Customizable Contact Forms 6.0.4
• Fluent Forms – Customizable Contact Forms 6.1.0
• Fluent Forms – Customizable Contact Forms 6.1.1
• Fluent Forms – Customizable Contact Forms 6.1.2
• Fluent Forms – Customizable Contact Forms 6.1.3
• Fluent Forms – Customizable Contact Forms 6.1.4
• Fluent Forms – Customizable Contact Forms 6.1.5
• Fluent Forms – Customizable Contact Forms 6.1.6
• Fluent Forms – Customizable Contact Forms 6.1.7
• Fluent Forms – Customizable Contact Forms 6.1.9
• Fluent Forms – Customizable Contact Forms 6.1.10
• Fluent Forms – Customizable Contact Forms 6.1.11
• Fluent Forms – Customizable Contact Forms 6.1.12
• Fluent Forms – Customizable Contact Forms 6.1.13
• Fluent Forms – Customizable Contact Forms 6.1.14
• Fluent Forms – Customizable Contact Forms 6.1.15
• Fluent Forms – Customizable Contact Forms 6.1.16
• Fluent Forms – Customizable Contact Forms 6.1.17
• Fluent Forms – Customizable Contact Forms 6.1.18
• Fluent Forms – Customizable Contact Forms 6.1.19

Fluent Forms up to 6.1.14 leaks the plugin’s admin AJAX nonce to every logged-in user on form preview pages, and the AI Form Builder endpoint only validated that nonce instead of checking a capability. A Subscriber-level attacker can therefore drive AI form generation and have the returned bare JavaScript stored as the form’s custom JS, which then executes for every visitor who views the generated form.

This vulnerability affects the following application versions:

• Fluent Forms – Customizable Contact Forms 5.0.0
• Fluent Forms – Customizable Contact Forms 5.0.1
• Fluent Forms – Customizable Contact Forms 5.0.2
• Fluent Forms – Customizable Contact Forms 5.0.3
• Fluent Forms – Customizable Contact Forms 5.0.4
• Fluent Forms – Customizable Contact Forms 5.0.5
• Fluent Forms – Customizable Contact Forms 5.0.6
• Fluent Forms – Customizable Contact Forms 5.0.7
• Fluent Forms – Customizable Contact Forms 5.0.8
• Fluent Forms – Customizable Contact Forms 5.0.9
• Fluent Forms – Customizable Contact Forms 5.0.10
• Fluent Forms – Customizable Contact Forms 5.0.11
• Fluent Forms – Customizable Contact Forms 5.0.12
• Fluent Forms – Customizable Contact Forms 5.1.0
• Fluent Forms – Customizable Contact Forms 5.1.1
• Fluent Forms – Customizable Contact Forms 5.1.2
• Fluent Forms – Customizable Contact Forms 5.1.3
• Fluent Forms – Customizable Contact Forms 5.1.4
• Fluent Forms – Customizable Contact Forms 5.1.5
• Fluent Forms – Customizable Contact Forms 5.1.7
• Fluent Forms – Customizable Contact Forms 5.1.8
• Fluent Forms – Customizable Contact Forms 5.1.9
• Fluent Forms – Customizable Contact Forms 5.1.10
• Fluent Forms – Customizable Contact Forms 5.1.11
• Fluent Forms – Customizable Contact Forms 5.1.12
• Fluent Forms – Customizable Contact Forms 5.1.13
• Fluent Forms – Customizable Contact Forms 5.1.14
• Fluent Forms – Customizable Contact Forms 5.1.15
• Fluent Forms – Customizable Contact Forms 5.1.16
• Fluent Forms – Customizable Contact Forms 5.1.17
• Fluent Forms – Customizable Contact Forms 5.1.18
• Fluent Forms – Customizable Contact Forms 5.1.19
• Fluent Forms – Customizable Contact Forms 5.1.20
• Fluent Forms – Customizable Contact Forms 5.2.0
• Fluent Forms – Customizable Contact Forms 5.2.1
• Fluent Forms – Customizable Contact Forms 5.2.2
• Fluent Forms – Customizable Contact Forms 5.2.3
• Fluent Forms – Customizable Contact Forms 5.2.4
• Fluent Forms – Customizable Contact Forms 5.2.5
• Fluent Forms – Customizable Contact Forms 5.2.6
• Fluent Forms – Customizable Contact Forms 5.2.7
• Fluent Forms – Customizable Contact Forms 5.2.8
• Fluent Forms – Customizable Contact Forms 5.2.9
• Fluent Forms – Customizable Contact Forms 5.2.10
• Fluent Forms – Customizable Contact Forms 5.2.11
• Fluent Forms – Customizable Contact Forms 5.2.12
• Fluent Forms – Customizable Contact Forms 6.0.0
• Fluent Forms – Customizable Contact Forms 6.0.1
• Fluent Forms – Customizable Contact Forms 6.0.2
• Fluent Forms – Customizable Contact Forms 6.0.3
• Fluent Forms – Customizable Contact Forms 6.0.4
• Fluent Forms – Customizable Contact Forms 6.1.0
• Fluent Forms – Customizable Contact Forms 6.1.1
• Fluent Forms – Customizable Contact Forms 6.1.2
• Fluent Forms – Customizable Contact Forms 6.1.3
• Fluent Forms – Customizable Contact Forms 6.1.4
• Fluent Forms – Customizable Contact Forms 6.1.5
• Fluent Forms – Customizable Contact Forms 6.1.6
• Fluent Forms – Customizable Contact Forms 6.1.7
• Fluent Forms – Customizable Contact Forms 6.1.8
• Fluent Forms – Customizable Contact Forms 6.1.9
• Fluent Forms – Customizable Contact Forms 6.1.10
• Fluent Forms – Customizable Contact Forms 6.1.11
• Fluent Forms – Customizable Contact Forms 6.1.12
• Fluent Forms – Customizable Contact Forms 6.1.13
• Fluent Forms – Customizable Contact Forms 6.1.14