CVE-2026-101324 — Fluent Forms reflected XSS via {get.*} in Custom HTML fields

What happened

Fluent Forms contains a reflected cross-site scripting vulnerability that can be triggered by an attacker-controlled value supplied to a {get.NAME} (described generally as {get.*}) SmartCode used inside a URL-accepting attribute (for example an iframe src or an a href) within a published Custom HTML field. If a user is tricked into performing an action such as clicking a crafted link, injected script can execute in that user's browser. (Source IDs: 8619, 32388)

Technical cause

The root cause reported is insufficient input sanitization and output escaping for attacker-controlled values expanded by {get.*} SmartCodes when placed inside URL-accepting attributes in Custom HTML fields. This allows reflected script to be returned and executed in a user's browser when the crafted input is returned in the page context. (Source IDs: 8619, 32388)

Why it matters

An unauthenticated actor can supply the attacker-controlled value used by the SmartCode; successful exploitation relies on tricking a user into activating the crafted input (for example by clicking a link). The CVSS v3.1 base score is 4.7 (vector: AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N), indicating a network-reachable issue that requires user interaction and yields limited confidentiality and integrity impact but a scope change. (Source IDs: 8619, 32388)

Who is affected

Sites using the Fluent Forms WordPress plugin with the vulnerable range (versions up to and including 6.2.14) are affected if an administrator has published a form containing a Custom HTML field that uses a {get.*} SmartCode inside a URL-accepting attribute. Not all Fluent Forms installations are affected — the site must have that specific configuration. (Source IDs: 8619, 32388)

Discovery and timeline

The advisory records publication on 2026-10-09 and an update on 2026-10-10 in the source records. The NVD and WPVulnerability entries list the vulnerability as CVE-2026-101324. The available metadata indicates there is no public exploit and it is not marked as known exploited. The advisory data does not provide information about an individual discoverer or a vendor statement. (Source IDs: 8619, 32388)

Affected versions

The advisory identifies affected versions as up to and including 6.2.14, and reports a fix in 6.2.15. (Source IDs: 8619, 32388)

Fixes and mitigation

Package metadata reports a fixed release of the Fluent Forms plugin in 6.2.15 (see source). However, the advisory record also includes a field that indicates 'fix_available' is false. These two facts conflict. If 6.2.15 is available to you, update to 6.2.15. As an immediate mitigation, review published forms for Custom HTML fields that embed {get.*} SmartCodes inside URL-accepting attributes and remove or disable those fields where possible. (Source IDs: 8619, 32388)

Recommended action

1) If you can obtain the 6.2.15 update from your plugin source, apply it. 2) Audit published forms for Custom HTML fields that use {get.*} SmartCodes inside URL-accepting attributes and remove or alter those fields to avoid expanding untrusted input into URL attributes. 3) Review administrator privileges and restrict who can publish or edit Custom HTML fields. Verify changes on a staging site before applying to production. (Source IDs: 8619, 32388)