CVE-2026-101324Published
Fluent Forms <= 6.2.14 - Reflected Cross-Site Scripting via '{get.*}' Editor SmartCode Parameter
Exact source revision recorded 23 Oct 2026 15:48:27 UTC. It does not establish the source's current position. Latest evidence.
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-101324 · Microsoft / collected KEV context
cve-program · CVE-2026-101324
- https://www.wordfence.com/threat-intel/vulnerabilities/id/4b28ac94-fc84-4560-bffd-273566cc0f91?source=cve
- https://plugins.trac.wordpress.org/browser/fluentform/tags/6.2.14/app/Services/FormBuilder/EditorShortcodeParser.php#L169
- https://plugins.trac.wordpress.org/browser/fluentform/tags/6.2.14/app/Services/FormBuilder/Components/CustomHtml.php#L40
- https://plugins.trac.wordpress.org/browser/fluentform/tags/6.2.14/boot/globals.php#L326
- https://plugins.trac.wordpress.org/browser/fluentform/tags/6.2.14/app/Modules/Component/Component.php#L890
- https://plugins.trac.wordpress.org/browser/fluentform/tags/6.2.14/app/Services/FormBuilder/EditorShortcodeParser.php#L78
- https://wordpress.org/plugins/fluentform/
- https://plugins.trac.wordpress.org/changeset/3721107/fluentform/trunk/app/Modules/Component/Component.php
Current operational correlations are not mixed into this historical source record. Open latest evidence to discover current connections.