What is CVE-2026-18146?
This vulnerability is a Stored Cross-Site Scripting (XSS) in the Fluent Forms WordPress plugin via Notification Smartcode Values. It affects all versions up to and including 6.2.11 due to improper input sanitization and output escaping. Users should update to the patched version and restrict user input where possible.
Azərbaycanca: Bu zəiflik Fluent Forms WordPress plaginində saxlanılan XSS (Stored Cross-Site Scripting) hücumuna səbəb olur. Təsir Notification Smartcode Values funksiyasına aiddir və 6.2.11 daxil olmaqla bütün versiyaları əhatə edir. İstifadəçilər plagini ən son versiyaya yeniləməli və daxilolmaları məhdudlaşdırmalıdır.
Related CVEs
link basis: same weakness class CWE-79
FAQ2
Which versions of the Fluent Forms plugin are affected by CVE-2026-18146?
This vulnerability affects all versions of Fluent Forms up to and including 6.2.11.
What is the primary mitigation recommended for CVE-2026-18146 in Fluent Forms?
Users should update the plugin to the patched version and restrict user input where possible.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.