Stored Cross-Site Scripting in Fluent Forms Notification Smartcodes

Unauthenticated attackers can store arbitrary JavaScript through Fluent Forms notification smartcode values such as {cookie.*}, which executes in an administrator’s browser when they view the form’s submission logs. The {user.*} smartcode could also expose sensitive user fields such as the password hash. Sites running Fluent Forms 6.2.11 and earlier are affected.

This vulnerability affects the following application versions:

• Fluent Forms – Customizable Contact Forms 3.5.0
• Fluent Forms – Customizable Contact Forms 3.5.1
• Fluent Forms – Customizable Contact Forms 3.5.2
• Fluent Forms – Customizable Contact Forms 3.5.3
• Fluent Forms – Customizable Contact Forms 3.5.4
• Fluent Forms – Customizable Contact Forms 3.5.5
• Fluent Forms – Customizable Contact Forms 3.5.6
• Fluent Forms – Customizable Contact Forms 3.6.0
• Fluent Forms – Customizable Contact Forms 3.6.2
• Fluent Forms – Customizable Contact Forms 3.6.21
• Fluent Forms – Customizable Contact Forms 3.6.22
• Fluent Forms – Customizable Contact Forms 3.6.31
• Fluent Forms – Customizable Contact Forms 3.6.40
• Fluent Forms – Customizable Contact Forms 3.6.41
• Fluent Forms – Customizable Contact Forms 3.6.42
• Fluent Forms – Customizable Contact Forms 3.6.50
• Fluent Forms – Customizable Contact Forms 3.6.51
• Fluent Forms – Customizable Contact Forms 3.6.60
• Fluent Forms – Customizable Contact Forms 3.6.61
• Fluent Forms – Customizable Contact Forms 3.6.62
• Fluent Forms – Customizable Contact Forms 3.6.64
• Fluent Forms – Customizable Contact Forms 3.6.65
• Fluent Forms – Customizable Contact Forms 3.6.66
• Fluent Forms – Customizable Contact Forms 3.6.67
• Fluent Forms – Customizable Contact Forms 3.6.68
• Fluent Forms – Customizable Contact Forms 3.6.69
• Fluent Forms – Customizable Contact Forms 3.6.70
• Fluent Forms – Customizable Contact Forms 3.6.71
• Fluent Forms – Customizable Contact Forms 3.6.72
• Fluent Forms – Customizable Contact Forms 3.6.73
• Fluent Forms – Customizable Contact Forms 3.6.74
• Fluent Forms – Customizable Contact Forms 4.0.0
• Fluent Forms – Customizable Contact Forms 4.0.1
• Fluent Forms – Customizable Contact Forms 4.1.0
• Fluent Forms – Customizable Contact Forms 4.1.5
• Fluent Forms – Customizable Contact Forms 4.1.51
• Fluent Forms – Customizable Contact Forms 4.2.0
• Fluent Forms – Customizable Contact Forms 4.2.1
• Fluent Forms – Customizable Contact Forms 4.3.0
• Fluent Forms – Customizable Contact Forms 4.3.1
• Fluent Forms – Customizable Contact Forms 4.3.2
• Fluent Forms – Customizable Contact Forms 4.3.3
• Fluent Forms – Customizable Contact Forms 4.3.4
• Fluent Forms – Customizable Contact Forms 4.3.5
• Fluent Forms – Customizable Contact Forms 4.3.6
• Fluent Forms – Customizable Contact Forms 4.3.7
• Fluent Forms – Customizable Contact Forms 4.3.8
• Fluent Forms – Customizable Contact Forms 4.3.9
• Fluent Forms – Customizable Contact Forms 4.3.10
• Fluent Forms – Customizable Contact Forms 4.3.11
• Fluent Forms – Customizable Contact Forms 4.3.12
• Fluent Forms – Customizable Contact Forms 4.3.13
• Fluent Forms – Customizable Contact Forms 4.3.14
• Fluent Forms – Customizable Contact Forms 4.3.15
• Fluent Forms – Customizable Contact Forms 4.3.16
• Fluent Forms – Customizable Contact Forms 4.3.17
• Fluent Forms – Customizable Contact Forms 4.3.18
• Fluent Forms – Customizable Contact Forms 4.3.19
• Fluent Forms – Customizable Contact Forms 4.3.20
• Fluent Forms – Customizable Contact Forms 4.3.21
• Fluent Forms – Customizable Contact Forms 4.3.22
• Fluent Forms – Customizable Contact Forms 4.3.23
• Fluent Forms – Customizable Contact Forms 4.3.24
• Fluent Forms – Customizable Contact Forms 4.3.25
• Fluent Forms – Customizable Contact Forms 5.0.0
• Fluent Forms – Customizable Contact Forms 5.0.1
• Fluent Forms – Customizable Contact Forms 5.0.2
• Fluent Forms – Customizable Contact Forms 5.0.3
• Fluent Forms – Customizable Contact Forms 5.0.4
• Fluent Forms – Customizable Contact Forms 5.0.5
• Fluent Forms – Customizable Contact Forms 5.0.6
• Fluent Forms – Customizable Contact Forms 5.0.7
• Fluent Forms – Customizable Contact Forms 5.0.8
• Fluent Forms – Customizable Contact Forms 5.0.9
• Fluent Forms – Customizable Contact Forms 5.0.10
• Fluent Forms – Customizable Contact Forms 5.0.11
• Fluent Forms – Customizable Contact Forms 5.0.12
• Fluent Forms – Customizable Contact Forms 5.1.0
• Fluent Forms – Customizable Contact Forms 5.1.1
• Fluent Forms – Customizable Contact Forms 5.1.2
• Fluent Forms – Customizable Contact Forms 5.1.3
• Fluent Forms – Customizable Contact Forms 5.1.4
• Fluent Forms – Customizable Contact Forms 5.1.5
• Fluent Forms – Customizable Contact Forms 5.1.7
• Fluent Forms – Customizable Contact Forms 5.1.8
• Fluent Forms – Customizable Contact Forms 5.1.9
• Fluent Forms – Customizable Contact Forms 5.1.10
• Fluent Forms – Customizable Contact Forms 5.1.11
• Fluent Forms – Customizable Contact Forms 5.1.12
• Fluent Forms – Customizable Contact Forms 5.1.13
• Fluent Forms – Customizable Contact Forms 5.1.14
• Fluent Forms – Customizable Contact Forms 5.1.15
• Fluent Forms – Customizable Contact Forms 5.1.16
• Fluent Forms – Customizable Contact Forms 5.1.17
• Fluent Forms – Customizable Contact Forms 5.1.18
• Fluent Forms – Customizable Contact Forms 5.1.19
• Fluent Forms – Customizable Contact Forms 5.1.20
• Fluent Forms – Customizable Contact Forms 5.2.0
• Fluent Forms – Customizable Contact Forms 5.2.1
• Fluent Forms – Customizable Contact Forms 5.2.2
• Fluent Forms – Customizable Contact Forms 5.2.3
• Fluent Forms – Customizable Contact Forms 5.2.4
• Fluent Forms – Customizable Contact Forms 5.2.5
• Fluent Forms – Customizable Contact Forms 5.2.6
• Fluent Forms – Customizable Contact Forms 5.2.7
• Fluent Forms – Customizable Contact Forms 5.2.8
• Fluent Forms – Customizable Contact Forms 5.2.9
• Fluent Forms – Customizable Contact Forms 5.2.10
• Fluent Forms – Customizable Contact Forms 5.2.11
• Fluent Forms – Customizable Contact Forms 5.2.12
• Fluent Forms – Customizable Contact Forms 6.0.0
• Fluent Forms – Customizable Contact Forms 6.0.1
• Fluent Forms – Customizable Contact Forms 6.0.2
• Fluent Forms – Customizable Contact Forms 6.0.3
• Fluent Forms – Customizable Contact Forms 6.0.4
• Fluent Forms – Customizable Contact Forms 6.1.0
• Fluent Forms – Customizable Contact Forms 6.1.1
• Fluent Forms – Customizable Contact Forms 6.1.2
• Fluent Forms – Customizable Contact Forms 6.1.3
• Fluent Forms – Customizable Contact Forms 6.1.4
• Fluent Forms – Customizable Contact Forms 6.1.5
• Fluent Forms – Customizable Contact Forms 6.1.6
• Fluent Forms – Customizable Contact Forms 6.1.7
• Fluent Forms – Customizable Contact Forms 6.1.8
• Fluent Forms – Customizable Contact Forms 6.1.9
• Fluent Forms – Customizable Contact Forms 6.1.10
• Fluent Forms – Customizable Contact Forms 6.1.11
• Fluent Forms – Customizable Contact Forms 6.1.12
• Fluent Forms – Customizable Contact Forms 6.1.13
• Fluent Forms – Customizable Contact Forms 6.1.14
• Fluent Forms – Customizable Contact Forms 6.1.15
• Fluent Forms – Customizable Contact Forms 6.1.16
• Fluent Forms – Customizable Contact Forms 6.1.17
• Fluent Forms – Customizable Contact Forms 6.1.18
• Fluent Forms – Customizable Contact Forms 6.1.19
• Fluent Forms – Customizable Contact Forms 6.1.20
• Fluent Forms – Customizable Contact Forms 6.1.21
• Fluent Forms – Customizable Contact Forms 6.2.0
• Fluent Forms – Customizable Contact Forms 6.2.1
• Fluent Forms – Customizable Contact Forms 6.2.2
• Fluent Forms – Customizable Contact Forms 6.2.3
• Fluent Forms – Customizable Contact Forms 6.2.4
• Fluent Forms – Customizable Contact Forms 6.2.5
• Fluent Forms – Customizable Contact Forms 6.2.6
• Fluent Forms – Customizable Contact Forms 6.2.7
• Fluent Forms – Customizable Contact Forms 6.2.8
• Fluent Forms – Customizable Contact Forms 6.2.9
• Fluent Forms – Customizable Contact Forms 6.2.10
• Fluent Forms – Customizable Contact Forms 6.2.11