CVE-2026-11881

Fluent Forms < 6.2.6 - Contributor+ Stored XSS via Date/Time Field

The Fluent Forms WordPress plugin before 6.2.6 does not sanitise and escape one of its form field configuration settings before outputting it inside an inline script when a form is rendered, which could allow users with a role as low as Contributor (with delegated form-management permission, and therefore lacking the unfiltered_html capability, e.g. in a multisite setup) to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor who loads the form, including administrators previewing it.

We have discovered 96,122 live websites that are affected by CVE-2026-11881.

Run a Free Instant Scan



Affected Software

Product  Fluentform
Category Wordpress Plugins
Vulnerable Domains96,122 live websites (100% of Fluentform install base)
Vulnerable Versions
  • from 0 through 6.2.6
Vulnerable Versions Count105 versions ( 100% of all versions)


Common Weakness Enumeration

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')



Details

  • Published - Jul 30, 2026
  • Updated - Jul 30, 2026

Credits

  • Muni Nitish Kumar Yaddala (finder)
  • WPScan (coordinator)

Website Distribution by Country

Number of websites using CVE-2026-11881
United States30,034 websites


Germany10,013 websites
GB5,779 websites
France4,667 websites
Netherlands3,506 websites
India2,539 websites
Australia2,522 websites
Italy2,403 websites
Canada2,333 websites
Poland2,094 websites

Website Distribution by TLD

Number of websites using CVE-2026-11881
.com41,402 websites
.de5,998 websites
.org4,428 websites
.co.uk3,457 websites
.nl3,180 websites
.com.au2,374 websites
.fr2,140 websites
.net1,862 websites
.it1,769 websites
.com.br1,755 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-11881

Top websites that are affected by CVE-2026-11881. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
***.***.ca Canada*,***
**********.com United States*,***
********.com United States*,***
***************.com United States*,***
*****************.com United States*,***
********************.com Thailand**,***
********.com Germany**,***
*********************.fr France**,***
************.vn Vietnam**,***
**********************.org United States**,***
See full domain list

FAQ

CVE-2026-11881 is Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Fluentform
A total of 96,122 websites have been identified as vulnerable to CVE-2026-11881, based on global website indexing conducted by WebTechSurvey.
The Fluentform is affected by the CVE-2026-11881 vulnerability.
Fluentform versions up to 6.2.6 are vulnerable to CVE-2026-11881.
CVE-2026-11881 is resolved in version 6.2.6 of Fluentform.