Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder vulnerabilities

5 known vulnerabilities in Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder from Techjewel. 5 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.2 High severity

  Fluent Forms – Customizable Contact Forms…: Authorization Bypass Through User-Controlled Key

  CVE-2026-5395May 14, 2026Techjewel

  The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.2.0 via the exportEntries function due to missing validati

• 8.2 High severity

  Fluent Forms – Customizable Contact Forms…: Authorization Bypass Through User-Controlled Key

  CVE-2026-5396May 14, 2026Techjewel

  The Fluent Forms plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to, and including, 6.1.21. This is due to the SubmissionPolicy class authorizing submission-level actions (read, modify, delete, add note

• 8.8 High severity

  Fluent Forms – Customizable Contact Forms…: Deserialization of Untrusted Data

  CVE-2024-4157May 22, 2024Techjewel

  The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.1.15 via deserialization of untrusted input in the extractDynamicValues

• 7.5 High severity

  Fluent Forms – Customizable Contact Forms…: Missing Authorization

  CVE-2024-2782May 18, 2024TechjewelEPSS 1.23%

  The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the /wp-json/fluentform/v1/global-settings REST API endpoint

• 9.8 Critical severity

  Fluent Forms – Customizable Contact Forms…: Missing Authorization

  CVE-2024-2771May 18, 2024TechjewelEPSS 2.86%

  The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the /wp-json/fluentform/v1/managers REST API endpoint in all versions up t