CVE-2026-16655

Fluent Forms <= 6.2.7 - Unauthenticated Stored Cross-Site Scripting via Name Field Nested `password` Member

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Name Field Nested `password` Member in all versions up to, and including, 6.2.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

We have discovered 96,122 live websites that are affected by CVE-2026-16655.

Run a Free Instant Scan



Affected Software

Product  Fluentform
Category Wordpress Plugins
Vulnerable Domains96,122 live websites (100% of Fluentform install base)
Vulnerable Versions
  • from 0 through 6.2.7
Vulnerable Versions Count105 versions ( 100% of all versions)


Common Weakness Enumeration

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')



Details

  • Published - Jul 29, 2026
  • Updated - Jul 29, 2026

Credits

  • daroo (finder)

Website Distribution by Country

Number of websites using CVE-2026-16655
United States30,034 websites


Germany10,013 websites
GB5,779 websites
France4,667 websites
Netherlands3,506 websites
India2,539 websites
Australia2,522 websites
Italy2,403 websites
Canada2,333 websites
Poland2,094 websites

Website Distribution by TLD

Number of websites using CVE-2026-16655
.com41,402 websites
.de5,998 websites
.org4,428 websites
.co.uk3,457 websites
.nl3,180 websites
.com.au2,374 websites
.fr2,140 websites
.net1,862 websites
.it1,769 websites
.com.br1,755 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-16655

Top websites that are affected by CVE-2026-16655. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
***.***.ca Canada*,***
**********.com United States*,***
********.com United States*,***
***************.com United States*,***
*****************.com United States*,***
********************.com Thailand**,***
********.com Germany**,***
*********************.fr France**,***
************.vn Vietnam**,***
**********************.org United States**,***
See full domain list

FAQ

CVE-2026-16655 is Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Fluentform
A total of 96,122 websites have been identified as vulnerable to CVE-2026-16655, based on global website indexing conducted by WebTechSurvey.
The Fluentform is affected by the CVE-2026-16655 vulnerability.
Fluentform versions up to and including 6.2.7 are vulnerable to CVE-2026-16655.

References