A critical Stored Cross-Site Scripting vulnerability in the Fluent Forms Pro plugin allows unauthenticated attackers to inject malicious scripts, potentially compromising administrative sessions.

This vulnerability occurs because the draft form submission endpoint lacks authentication and nonce verification, and fails to properly sanitize input. Unauthenticated attackers can inject arbitrary web scripts that execute when an administrator views a partial form entry.

Successful exploitation allows an attacker to execute arbitrary scripts in the browser of an administrative user. This can lead to unauthorized actions performed on behalf of the administrator, data exfiltration, or further compromise of the WordPress environment. Given the CVSS score of 7.2, this vulnerability represents a high risk to the integrity and confidentiality of the administrative interface.

Immediate Action: Update the TechJewel Fluent Forms Pro plugin to the latest version, which contains the necessary input sanitization and security checks.

Proactive Monitoring: Monitor WordPress access logs and administrative activity for unusual AJAX requests or unexpected script behavior within the forms module.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block suspicious or malformed AJAX requests targeting form submission endpoints.

Public Exploit Available: Unknown.

The severity of this issue is elevated by the lack of required authentication for the vulnerable endpoint. Security teams must prioritize updating the Fluent Forms Pro plugin immediately to prevent potential administrative account compromise. If an update cannot be performed, administrators should temporarily disable the affected plugin functionality to mitigate the risk of script injection.