Fluent CRM EUVD-2026-43370

Exploitation requires victim interaction (CVSS UI:R): a target user must open an attacker-crafted request to the Fluent CRM component that reflects the payload - the description confirms this is Reflected XSS, not stored, so there is no persistent trigger and each attack must be delivered per-victim. No authentication is required of the attacker (PR:N), but meaningful impact depends on the victim being an authenticated WordPress user (ideally an administrator) whose session and wp-admin privileges the injected script can abuse; against an unauthenticated visitor the payload runs with no privileged context. Affected deployments are any WordPress site running Fluent CRM at version 3.1.7 or earlier. The chief limiting factors are the mandatory user interaction and the dependence on the victim's privilege level.

The signals are moderate and mostly self-consistent. The CVSS 3.1 base score is 7.1 (High) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L: network-reachable, low complexity, no privileges, but it requires user interaction (UI:R), which is the primary limiting factor - a victim, ideally a logged-in admin, must click the malicious link. The changed scope (S:C) and Low impacts across C/I/A reflect typical reflected-XSS session/DOM abuse rather than full compromise. No EPSS score was provided in the input, so exploitation probability cannot be quantified here. It is not in CISA KEV (no active exploitation confirmed) and no POC is referenced, so this is a credible-but-not-urgent priority: a real, patchable web vulnerability whose exploitation depends on social engineering rather than automated mass exploitation. Reflected XSS is generally not automatable at scale because it needs per-victim interaction.

An attacker crafts a URL to the site's Fluent CRM endpoint containing a malicious script payload in a reflected parameter and sends it to a logged-in WordPress administrator via email or chat. When the admin opens the link, the payload reflects into the page and executes in their authenticated session, allowing the attacker to steal the session, perform admin actions, or plant further malicious content. No public POC is referenced, and success depends on the victim clicking (UI:R) while authenticated.