CVE-2024-4709mediumCWE-79

CVE-2024-4709: medium-severity vulnerability in techjewel Fluent Forms – Customizable Contact…

Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published · Updated

Follow this CVE+ Monitor Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.4epss 0.4%
The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘subject’ parameter in versions up to, and including, 5.1.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, and access granted by an administrator, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Affected products
techjewel · Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
Related CVEs — techjewel Fluent Forms – Customizable Contact…

In the same product, most dangerous first.

CVE-2024-2771CRITICALContact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Missing Authorization to Settings Update and Limited Privilege EscalationEPSS 2.9%CVE-2024-2782HIGHContact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Missing Authorization to Setting ManipulationEPSS 1.2%CVE-2024-4157HIGHContact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.15 - PHP Object Injection via extractDynamicValuesEPSS 0.7%CVE-2025-9260MEDIUMFluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder 5.1.16 - 6.1.1 - Authenticated (Subscriber+) PHP Object Injection To Arbitrary File ReadEPSS 0.6%CVE-2026-6344MEDIUMFluent Forms <= 6.2.1 - Authenticated (Administrator+) Arbitrary File Read via Path Traversal in Email AttachmentEPSS 0.6%CVE-2024-0618MEDIUMFluent Forms <= 5.1.5 - Authenticated(Administrator+) Stored Cross-Site Scripting via imported form titleEPSS 0.5%