What is the CVSS score of CVE-2026-57715?

CVE-2026-57715 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Which versions of Fluent CRM are affected by CVE-2026-57715?

The WPManageNinja Fluent CRM plugin, widely deployed in WordPress installations, contains a critical vulnerability allowing attackers to hijack administrator accounts through specially crafted links,…

How to fix or mitigate CVE-2026-57715?

Within 24 hours, immediately disable or deactivate the WPManageNinja Fluent CRM plugin (all versions through 3.1.7) across all WordPress installations. Within 7 days, conduct a comprehensive audit of WordPress administrator access logs and CRM activity logs for evidence of account hijacking or unauthorized data access, and reset all WordPress administrator passwords as a precaution. Within 30 days, either apply the vendor patch once released or migrate to an alternative CRM solution; if continued use is necessary, implement a Web Application Firewall with XSS filtering rules and restrict wp-admin access to trusted internal IP addresses only.

Fluent CRM CVE-2026-57715

EUVD-2026-43370 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-13 Patchstack

WordPress XSS Wordpress Plugin Fluent Crm Wpmanageninja

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Network-delivered reflected XSS needs no attacker privileges but requires victim click (UI:R); scope change (S:C) into the browser context yields limited C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:46 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPManageNinja Fluent CRM fluent-crm allows Reflected XSS.This issue affects Fluent CRM: from n/a through <= 3.1.7.

AnalysisAI

Reflected cross-site scripting in the WPManageNinja Fluent CRM WordPress plugin (all versions through 3.1.7) lets a remote unauthenticated attacker inject script that executes in a victim's browser when they follow a crafted link. Because the CVSS scope is changed (S:C), successful exploitation can affect resources beyond the vulnerable component, typically hijacking an authenticated WordPress admin session within the wp-admin context. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

Fluent CRM is a self-hosted email-marketing and CRM automation plugin for WordPress, commonly operated from the wp-admin dashboard by site administrators and marketing staff. The flaw is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the reflected variant: user-controllable input supplied in a request parameter is echoed back into a generated page without adequate output encoding or input sanitization, so an attacker-supplied payload is parsed as active markup/JavaScript by the browser. The affected component is identified by the CPE cpe:2.3:a:wpmanageninja:fluent_crm:*:*:*:*:*:*:*:*, covering all released versions up to and including 3.1.7. Reflected XSS differs from stored XSS in that the payload is not persisted server-side but delivered per-request, requiring the victim to be lured into triggering the crafted request (UI:R).

RemediationAI

Upgrade Fluent CRM to a version later than 3.1.7 as soon as the vendor publishes a fixed release; the input data does not include an exact patched version number, so no vendor-released fixed version can be independently confirmed at time of analysis - consult the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/fluent-crm/vulnerability/wordpress-fluent-crm-plugin-3-1-7-cross-site-scripting-xss-vulnerability?_s_id=cve) and the WPManageNinja changelog for the corrected build. Until a patched version is applied, deploy a WordPress WAF or virtual patch (Patchstack offers one for this CVE) to filter XSS payloads on the affected endpoint, restrict wp-admin access by IP or authentication where feasible, and instruct administrators not to follow untrusted links that target the site's Fluent CRM parameters; note that WAF filtering can produce false positives on legitimate rich content and IP restrictions can disrupt remote admin workflows. A strict Content-Security-Policy that disallows inline script execution reduces impact but may break plugin UI features that rely on inline scripts.