CVE-2024-6518

Published
View on NVD ↗
CVSS v3
4.4
MEDIUM
CVSS v2
N/A
Affected
1
PROJECT

Description

The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via input fields in all versions up to, and including, 5.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

<h4>Fluent Forms is an advanced and lightweight Contact Form Builder</h4> <p><strong>Fluent Forms</strong> is the ultimate user-friendly, customizable <strong>drag-and-drop WP contact form plugin</strong> that offers you all the powerful features. It is a perfect <strong>no-code form builder</strong> for both beginners and advanced users.</p> <span class="embed-youtube" style="text-align:center; display: block;"><iframe loading="lazy" class="youtube-player" width="750" height="422" src="https://www.youtube.com/embed/s4RJS3GrmTI?version=3&#038;rel=1&#038;showsearch=0&#038;showinfo=1&#038;iv_load_policy=1&#038;fs=1&#038;hl=en-US&#038;autohide=2&#038;wmode=transparent" allowfullscreen="true" style="border:0;" sandbox="allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox"></iframe></span> <p><a href="https://fluentforms.com/form-templates/" rel="nofollow ugc">Demo</a> | <a href="https://fluentforms.com/docs/" rel="nofollow ugc">User Guide</a> | <a href="https://www.youtube.com/playlist?list=PLXpD0vT4thWEY6CbwMISKDiXOd5KPC6wo" rel="nofollow ugc">Youtube Video Tutorials</a> | <a href="https://wpmanageninja.com/support-tickets/" rel="nofollow ugc">Get Support</a> | <a href="https://www.facebook.com/groups/fluentforms/" rel="nofollow ugc">Official Facebook Community</a> | <a href="https://community.wpmanageninja.com/portal/space/fluent-forms/home" rel="nofollow ugc">Official Fluent Forms Community</a></p> <p>Anything from a simple contact form to a more advanced payment, quiz, or calculator form, Fluent Forms can meet virtually all your needs.</p> <h3>Powerful Features available in the Free Version</h3> <ul> <li>Drag &amp; drop builder</li> <li>Smart conditional logic</li> <li>Conversational form</li> <li>Built-in AI Form Builder</li> <li>25+ ready-to-use input fields</li> <li>Gutenberg Form Styler</li> <li>Reusable form templates</li> <li>Accept Payments with Stripe*</li> <li>Reporting Dashboard*</li> <li>Adjustable multi-column form layout</li> <li><a href="https://fluentforms.com/form-security/" rel="nofollow ugc">Spam protection using reCAPTCHA, hCaptcha &amp; more</a></li> <li>Email notification</li> <li>Form scheduling &amp; restriction</li> <li>Export/import forms</li> <li>Export entries in CSV/Excel/ODS/JSON format</li> <li>Filter entries &amp; Form Finder</li> <li>Undo/redo &amp; Form Edit history</li> <li>Role manager</li> <li>Form analytics &amp; Visual data report</li> <li>Set default value for input fields or populate from URL parameters</li> <li>Custom CSS &amp; JS</li> <li>Fully responsive &amp; accessible for users with special needs</li> <li>Migrate from WPForms, Contact Form 7, Gravity Forms, Ninja Forms &amp; Caldera Forms</li> </ul> <h3>Features available in the Pro version</h3> <ul> <li>55+ input fields</li> <li><a href="https://fluentforms.com/payment/" rel="nofollow ugc">Payment</a></li> <li><a href="https://fluentforms.com/numeric-calculation/" rel="nofollow ugc">Numeric calculation</a></li> <li><a href="https://fluentforms.com/multi-step-form/" rel="nofollow ugc">Multi-step form</a></li> <li><a href="https://fluentforms.com/advanced-form-styler/" rel="nofollow ugc">Advanced form styler</a></li> <li><a href="https://fluentforms.com/quiz-and-survey/" rel="nofollow ugc">Quiz &amp; survey module</a></li> <li>Inventory management</li> <li>Dynamic field</li> <li>Report module</li> <li>Advanced search filter</li> <li>Import form entries</li> <li>Admin approval</li> <li>Conditional confirmation messages</li> <li>Double opt-in</li> <li>Advanced form validation</li> <li>Auto-delete entries</li> <li>Landing page</li> <li>Geo-location provider</li> <li>SMS notifications</li> <li>Conditional email routing</li> <li>User registration</li> <li><a href="https://fluentforms.com/user-generated-content/" rel="nofollow ugc">Advanced post/CPT creation</a></li> <li><a href="https://fluentforms.com/address-autocomplete/" rel="nofollow ugc">Address autocomplete</a></li> <li><a href="https://fluentforms.com/integration/" rel="nofollow ugc">60+ third-party integrations</a> (and a lot more via Zapier)</li> </ul> <h3>Super Fast Contact Forms</h3> <p>Fluent Forms is optimized for speed, minimally impacting site performance with less than 30KB of combined CSS and JS for a standard form. This is significantly faster than most form builders, which load over 300KB of assets. Build the fastest online forms quickly.</p> <h3>Drag &amp; Drop Contact Form Builder</h3> <p>Our drag-and-drop form builder allows you to easily create any form you can imagine in a few minutes without writing any code.</p> <h3>Input Fields</h3> <p><strong>Available in the Free Version</strong></p> <ul> <li>Name Fields</li> <li>Email</li> <li>Simple Text</li> <li>Mask Input</li> <li>Text Area</li> <li>Address Fields</li> <li>Country List</li> <li>Numeric Field</li> <li>Dropdown</li> <li>Radio Field</li> <li>Checkbox</li> <li>Multiple Choice</li> <li>Website URL</li> <li>Time &amp; Date</li> <li>Custom HTML</li> <li>Hidden Field</li> <li>Section Break</li> <li>reCAPTCHA</li> <li>hCaptcha</li> <li>Turnstile</li> <li>Terms &amp; Conditions</li> <li>GDPR Agreement</li> <li>Password Field</li> <li>Custom Submit Button</li> <li>One/Two/Three/Four/Five/Six Column Container</li> <li>Payment Item</li> <li>Subscription</li> <li>Custom Payment Amount</li> <li>Item Quantity</li> <li>Payment Method</li> <li>Payment Summary</li> </ul> <p><strong>Available in the Pro Version</strong></p> <ul> <li>Image Upload</li> <li>File Upload</li> <li>Phone/Mobile</li> <li>Shortcode</li> <li>Action Hook</li> <li>Form Step</li> <li>Ratings</li> <li>Checkable Grid</li> <li>Range Slider</li> <li>Net Promoter Score</li> <li>Dynamic Field</li> <li>Chained Select</li> <li>Color Picker</li> <li>Repeat Field</li> <li>Post/CPT Selection</li> <li>Rich Text Input</li> <li>Save &amp; Resume</li> <li>Quiz Score</li> <li>Coupon</li> <li>Post Title</li> <li>Post Content</li> <li>Post Excerpt</li> <li>Featured Image</li> <li>Post Update</li> <li>Post Taxonomy Fields (Categories, Tags, Formats)</li> <li>Container Repeater</li> <li>Accordion/Tab</li> </ul> <h3>Gutenberg Form Styler</h3> <p>Customize form colors, typography, spacing, and borders directly within the Gutenberg interface. No more switching between editors or hunting for CSS selectors, style your forms right where you build your pages.</p> <h3>Fully Mobile Responsive Forms</h3> <p>Fluent Forms has been developed to make sure that it satisfies devices of all display sizes. Display your forms on all devices without any extra hassle.</p> <h3>Reusable Form Templates</h3> <p>Stop repetitive work. Fluent Forms offers pre-built forms with a single click, allowing quick tweaks and saving time. We provide dozens of useful templates for fast form building, including:<br /> * <strong>Contact Form</strong><br /> * <strong>Support Form</strong><br /> * <strong>Event Registration Form</strong><br /> * <strong>Vendor Contact Form</strong><br /> * <strong>Patient Intake Form</strong><br /> * <strong>Volunteer Application Form</strong><br /> * <strong>Request for Quote Form</strong><br /> * <strong>Conference Proposal Form</strong><br /> * <strong>Report a bug Form</strong><br /> * <strong>Polling Form</strong><br /> * <strong>Tell A Friend Form</strong><br /> * <strong>My Directory Information Form</strong><br /> * <strong>Request for Leave Form</strong><br /> * <strong>Admissions Form</strong><br /> * <strong>Loan Application Form</strong><br /> * <strong>Job Listing Form</strong><br /> * <strong>Website Feedback Form</strong><br /> * <strong>Comment &amp; Rating Form</strong><br /> * <strong>User Registration Form (Pro)</strong><br /> * <strong>Donation Form (Pro)</strong><br /> * <strong>Payment Form (Pro)</strong><br /> * <strong>Subscription Payments Form (Pro)</strong></p> <h3>Conversational Forms</h3> <p>Fluent Forms excels in creating various forms, notably its <a href="https://fluentforms.com/conversational-forms/" rel="nofollow ugc">conversational forms</a>. Unlike traditional forms, these present one question at a time, minimizing distraction and boosting completion rates. They offer multiple layout and sharing options (direct URLs, shortcodes, HTML embedding, etc.).</p> <span class="embed-youtube" style="text-align:center; display: block;"><iframe loading="lazy" class="youtube-player" width="750" height="422" src="https://www.youtube.com/embed/LSuZ7jOHLwE?version=3&#038;rel=1&#038;showsearch=0&#038;showinfo=1&#038;iv_load_policy=1&#038;fs=1&#038;hl=en-US&#038;autohide=2&#038;wmode=transparent" allowfullscreen="true" style="border:0;" sandbox="allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox"></iframe></span> <p><a href="https://fluentforms.com/?fluent-form=138" rel="nofollow ugc">View Conversational Form Demo</a><br /> Fluent Forms Pro offers advanced conversational forms. Users can navigate questions via scroll and key press, and customize fonts, colors, and backgrounds to align with their brand.</p> <h3>AI Form Builder</h3> <p>Say hello to Free AI Form Builder! Fluent Forms AI Form Builder simplifies and speeds up form creation. Just describe your needs to generate effective forms with all necessary fields.</p> <h3>Accept Payments with Stripe</h3> <p>Fluent Forms 6.0 now offers payment fields to free users, allowing Stripe payments for events, donations, or sales with a 1.9% transaction fee. Recurring payments are also included via the Subscription field. Pro removes the 1.9% fee, leaving only Stripe&#8217;s charges.</p> <h3>Fluent Forms Report Module</h3> <p>Fluent Forms Report Module provides powerful, data-informed insights through three sections: Overview, Payment, and Submissions. The free version includes basic analytics like submission/payment summaries, form ranking, API logs, and detailed charts. The Pro version unlocks advanced reporting, such as partial entry rates, submission data by country, and subscription analytics.</p> <h3>Built-in Data Visualization Tool</h3> <p>Fluent Forms allows easy analysis of form submissions with pie, bar, or tabular charts. As a form or quiz builder, it simplifies data analysis, providing real-time graphical results for surveys or polls.</p> <h3>Email Notification</h3> <p>Get notified every time someone submits a form and also send a confirmation email to the one who fills out the form. To make it more advanced, you can use conditional email notifications to send emails when certain conditions are met.</p> <h3>Multi-column Form Layout</h3> <p>Stack input fields in multiple columns and make the long, boring form appear compact and smart. This will lead to a lower form abandonment rate. There are six types of column containers to choose from.</p> <h3>Conditional Logic</h3> <p>Use <a href="https://fluentforms.com/conditional-logic/" rel="nofollow ugc">conditional logic</a> to show or hide form fields based on user behavior, preventing unnecessary clutter. Users can set multiple condition groups by selecting fields and defining rules (e.g., equal, greater than, includes). Conditional logic also allows for automatic email notifications and displaying different confirmation messages based on submission conditions.</p> <h3>Calculator for Advanced Form Calculation</h3> <p>Fluent Forms&#8217; numeric field enables creation of smart calculators like car loan, BMI, mortgage, or tax calculators with ease. You can define the acceptable range for these numerical inputs by setting minimum and maximum values.</p> <h3>Create PDF Files from Form Submission</h3> <p><a href="https://fluentforms.com/pdf-generator/" rel="nofollow ugc">Generate PDF from your submitted entries</a> and let users download the PDF file or send it via email. You can use this feature to generate invoices, create reports, or provide order summaries.</p> <h3>Conditional Confirmation</h3> <p>Fluent Forms Pro allows you to send customized confirmation messages to your users if they meet specific conditions.</p> <h3>Advanced Form Styler</h3> <p>Fluent Forms Pro&#8217;s Advanced Form Styler allows easy contact form customization to boost conversions. Adjust colors, fonts, box shadows, borders, margins, and padding. You can also quickly import styles from previous forms.</p> <h3>Build Quizzes &amp; Surveys</h3> <p>Fluent Forms Pro is a versatile tool, functioning as both a contact form and a powerful quiz builder. As a quiz plugin, it enables the creation of fun quizzes, personality tests, and trivia, with scoring assigned to questions. Users can see their performance immediately after submission or through email. It also supports running surveys and displaying the results.</p> <h3>Payment Forms</h3> <p>Fluent Forms Pro is a powerful solution for creating payment, product order, and donation forms, in addition to contact forms. It easily accepts credit card payments via integration with popular gateways like PayPal, Stripe, Razorpay, Paddle, Square, Paystack, Mollie and Authorize.net.<br /> <span class="embed-youtube" style="text-align:center; display: block;"><iframe loading="lazy" class="youtube-player" width="750" height="422" src="https://www.youtube.com/embed/78jS8G4j5q8?version=3&#038;rel=1&#038;showsearch=0&#038;showinfo=1&#038;iv_load_policy=1&#038;fs=1&#038;hl=en-US&#038;autohide=2&#038;wmode=transparent" allowfullscreen="true" style="border:0;" sandbox="allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox"></iframe></span></p> <h3>One-Click Migrator</h3> <p>If you are already using Contact Form 7, WPForms, Caldera Forms, Ninja Forms or Gravity Forms and looking to move to Fluent Forms, you can do this with a single click.</p> <h3>Fluent Forms CLI</h3> <p>Fluent Forms offers a powerful Command Line Interface (CLI) for managing forms without the graphical user interface. The CLI tool allows users to easily create, manage, import/export data, track submissions, and configure settings.</p> <h3>Enhanced Email Routing &amp; Automation</h3> <p>Boost website efficiency by using query strings to pre-fill visitor details and direct forms to designated teams via email routing, auto-response, and conditions.</p> <h3>Integrations and Add-ons Available in the Free Version</h3> <ul> <li><a href="https://wordpress.org/plugins/fluent-crm" rel="ugc">FluentCRM</a></li> <li><a href="https://wordpress.org/plugins/fluent-support" rel="ugc">Fluent Support</a></li> <li><a href="https://wordpress.org/plugins/fluent-boards" rel="ugc">FluentBoards</a></li> <li><a href="https://wordpress.org/plugins/fluent-smtp" rel="ugc">FluentSMTP</a></li> <li><a href="https://wordpress.org/plugins/ninja-tables" rel="ugc">Ninja Tables</a></li> <li><a href="https://wordpress.org/plugins/fluent-booking" rel="ugc">FluentBooking</a></li> <li><a href="https://wordpress.org/plugins/wp-social-reviews" rel="ugc">WP Social Ninja</a></li> <li><a href="https://wordpress.org/plugins/fluentforms-pdf" rel="ugc">Fluent Forms PDF Generator</a></li> <li><a href="https://fluentforms.com/integration/mailchimp/" rel="nofollow ugc">MailChimp</a></li> <li><a href="https://fluentforms.com/integration/slack/" rel="nofollow ugc">Slack</a></li> <li><a href="https://fluentforms.com/integration/mautic/" rel="nofollow ugc">Mautic</a></li> <li><a href="https://fluentforms.com/integration/mailpoet/" rel="nofollow ugc">Mailpoet</a></li> </ul> <h3>Integrations Available in the Pro Version</h3> <ul> <li>ActiveCampaign</li> <li>AffiliateWP</li> <li>Airtable</li> <li>amoCRM</li> <li>Automizy</li> <li>Brevo (formerly SendInBlue)</li> <li>BuddyBoss</li> <li>Campaign Monitor</li> <li>ChatGPT</li> <li>CleverReach</li> <li>ClickSend</li> <li>Constant Contact</li> <li>Kit, formerly ConvertKit</li> <li>Discord</li> <li>Drip</li> <li>Gist</li> <li>GetResponse</li> <li>Google Maps</li> <li>Google Sheets</li> <li>HubSpot</li> <li>iContact</li> <li>Insightly</li> <li>MailerLite</li> <li>Mailjet</li> <li>Mailster</li> <li>Mollie</li> <li>MooSend</li> <li>Notion</li> <li>OnePageCRM</li> <li>Paddle</li> <li>PayPal</li> <li>Paystack</li> <li>Pipedrive</li> <li>Platformly</li> <li>RazorPay</li> <li>Salesflare</li> <li>Salesforce</li> <li>SendFox</li> <li>Square</li> <li>Stripe</li> <li>Telegram</li> <li>Trello</li> <li>Twilo</li> <li>User Registration</li> <li>WebHook</li> <li>Zapier</li> <li>Zoho CRM</li> <li>Authorize.net</li> </ul> <h3>Check Out the Documentation and the Video Tutorials</h3> <p>Fluent Forms has detailed step-by-step documentation. Some essential documentations are provided below:</p> <ul> <li><a href="https://fluentforms.com/docs/getting-started-with-fluent-forms/" rel="nofollow ugc">Getting started with Fluent Forms</a></li> <li><a href="https://fluentforms.com/docs/setup-form-submission-confirmation-message-in-fluent-forms/" rel="nofollow ugc">Set up Form Submission Confirmation Message</a></li> <li><a href="https://fluentforms.com/docs/how-to-setup-admin-user-email-notifications/" rel="nofollow ugc">Setting up Email Notifications in Fluent Forms Plugin</a></li> <li><a href="https://fluentforms.com/docs/how-to-setup-admin-user-email-notifications/" rel="nofollow ugc">Send Email Notifications on Form Submission</a></li> <li><a href="https://fluentforms.com/docs/managing-entries-in-fluent-forms/" rel="nofollow ugc">Managing the Submitted Entries in Fluent Forms</a></li> <li><a href="https://fluentforms.com/docs/general-docs/field-types/" rel="nofollow ugc">Available Field Types in WordPress Forms</a></li> <li><a href="https://fluentforms.com/docs/set-up-forms-with-conditional-logic-in-fluent-forms/" rel="nofollow ugc">Set up Forms with Conditional Logic</a></li> <li><a href="https://fluentforms.com/docs/form-restrictions-feature-in-fluent-forms/" rel="nofollow ugc">WordPress Form Scheduling and Restriction Feature</a></li> <li><a href="https://fluentforms.com/docs/global-inventory-manager-in-fluent-forms/" rel="nofollow ugc">Global Inventory Manager in Fluent Forms</a></li> <li><a href="https://fluentforms.com/docs/general-docs/integrations/" rel="nofollow ugc">All Available CRM and Marketing Tools Integration Modules</a></li> </ul> <h3>What Our Users Say About Fluent Forms</h3> <blockquote> <p><strong>Fantastic Form Plugin!</strong><br /> I’ve tried a number of premium (and free) WP form plugins including Forminator Pro (by WPMU Dev) and Piotnet Forms. But I’ve come back to Fluent Forms as my favourite. It’s lightweight and easy to use!<br /> – By @jeremywardkcc</p> <p><strong>Best form plugin ever with first class support</strong><br /> This is the lightest form plugin I’ve ever used (except basic CF7 which is not enough for me). Great performances, great UI, great features, and above all, amazing dev/support team!!!<br /> Plugin is improving almost every week and they listen to you 🙂<br /> – By @yankiara</p> <p><strong>Agency Owner / Web Designer</strong><br /> Fluent forms is a great contact form plugin that allows customization and advanced features and addons such as taking payments. As a web designer / agency owner wpmanageninja is my go to for a lot of my software. Sure the software is great, but it is their support that keeps me coming back. I can count on them to assist me when my back is against the wall.<br /> – By @nickyeager123456</p> <p><strong>Powerful Form Plugin</strong><br /> Fluent Forms is very intuitive and easy to use form plugin. I am not an expert in website creation, and learned how to use it very easily. The documentation available in their official website is very usefull, it helps me a lot when in doubt on how to do something. The Pro is even better, and includes some functionalities that are worth it (if you need them, of course). Good deal with lifetime licence. Thank you.<br /> – By @francksdl</p> <p><strong>Excellent Support</strong><br /> Excellent customer service. I have fluent forms and fluent CRM, both pro versions, and not only do they work great but the support you get is excellent. Can totally recommend<br />
WordPress Plugin DirectoryWordPress Plugin Directory
17.1M