CVE-2024-9651: 
WordPress vulnerability analysis and mitigation

The Fluent Forms WordPress plugin before version 5.2.1 contains a stored Cross-Site Scripting (XSS) vulnerability. The vulnerability was discovered on November 18, 2024, and affects the plugin's settings functionality. The issue stems from inadequate sanitization and escaping of certain settings, potentially impacting WordPress installations, particularly in multisite setups (WPScan).

The vulnerability is classified as a Stored Cross-Site Scripting (XSS) issue that affects high-privilege users such as administrators. The CVSS v3.1 base score is 6.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The vulnerability exists in the form editing functionality, specifically in the Custom Error Message field within the Your Email section (WPScan).

The vulnerability allows high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks, even when the unfiltered_html capability is disallowed. This is particularly significant in multisite setups where such capabilities are typically restricted (WPScan).

The vulnerability has been patched in version 5.2.1 of the Fluent Forms WordPress plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).