CVE Database /
CVE-2025-69001
CVE · Medium
CVE-2025-69001 — Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder [fluentform] < 6.1.12
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2025-69001
|
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder [fluentform] < 6.1.12 |
Improper Control of Generation of Code ('Code Injection') |
Medium
5.3
|
< 6.1.12
|
6.1.12 |
2026-01-13 |
—
|
CVE-2025-69001
The Fluent Forms plugin for WordPress contains a flaw in its processing of user input, allowing malicious individuals to trigger any shortcode without authentication. This vulnerability affects all versions up to and including 6.1.11, where the plugin fails to verify values before executing them. As a result, attackers can execute arbitrary shortcodes.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings