FluentCommunity CVE-2026-66467

Exploitation requires the attacker to hold a valid subscriber-level (or higher) WordPress user account on the target site - this is the minimum registered user role in WordPress. Sites with open registration are therefore at significantly higher risk as attackers can self-register. Additionally, exploitation requires that a privileged user (such as an administrator) actively views or interacts with the community content containing the injected payload (UI:R); the attack does not execute autonomously on the server. The FluentCommunity plugin must be installed and active. Limiting factors include: the need for an authenticated attacker account (not a zero-interaction attack), the dependency on admin user interaction with community content, and the requirement that the site uses FluentCommunity versions 2.7.5 or below. Sites with closed registration or where only trusted users hold subscriber roles have substantially reduced exposure.

The CVSS 6.5 Medium score reflects meaningful but bounded risk: AV:N/AC:L confirms network-accessible exploitation with no special configuration complexity, while PR:L caps the threat to environments where attacker-controlled subscriber accounts exist, and UI:R requires a privileged user to view the injected content. EPSS data was not provided in the intelligence sources, so exploitation probability cannot be quantified. No CISA KEV listing is present, and no POC code is referenced - exploitation status is 'no public exploit identified at time of analysis.' In practice, XSS-via-subscriber-to-admin is a well-understood WordPress attack chain with real consequences: successful exploitation can yield full administrative takeover via session cookie theft or CSRF-chained actions. The risk is highest for sites with open registration (allowing attacker subscriber accounts) and active admin engagement with community content. The A:L availability impact in the vendor CVSS vector is atypical for XSS and may be inflated; concrete availability impact is not described in available data.

An attacker registers a subscriber account on a WordPress site running FluentCommunity, then submits a community post or profile field containing a crafted JavaScript payload such as a cookie-stealing script. When a site administrator navigates to view community content and encounters the injected payload, the script executes in the administrator's browser session, exfiltrating their session cookie or WordPress nonce to an attacker-controlled endpoint, enabling full administrative account takeover without requiring further interaction.