Fluent Boards Pro EUVD-2026-66936

Exploitation requires a valid subscriber-level (or higher) account on the target WordPress site - anonymous unauthenticated attackers cannot trigger this vulnerability. The site must be running Fluent Boards Pro version 2.0.11 or earlier. Successful impact additionally requires that a higher-privileged user (e.g., editor or administrator) visits and renders the attacker-controlled board content in their browser (UI:R). Limiting factors include: sites with closed user registration or invite-only subscriber creation significantly reduce the realistic attacker pool; sites where only trusted internal users hold subscriber accounts face lower practical risk. The CVSS vector PR:L confirms at least subscriber-level authentication is mandatory - unauthenticated exploitation is not possible.

The CVSS 6.5 Medium score reflects a balanced real-world risk profile: network-accessible (AV:N), low complexity (AC:L), and requiring only subscriber-level privileges (PR:L), but gated by required user interaction (UI:R) and producing only low individual impact ratings (C:L/I:L/A:L). The changed scope (S:C) is the critical signal - this is not a self-contained subscriber-only flaw but one that can cascade to higher-privileged users. On a typical WordPress site where user registration is open, any subscriber account becomes a viable attack origin. EPSS data is not provided, but the class of subscriber-level stored XSS in WordPress plugins has historically seen moderate exploitation by opportunistic actors targeting admin session cookies. No KEV listing and no confirmed POC limit urgency, but the low barrier to exploitation (any registered user) means patching should not be deferred on sites with open registration or untrusted subscriber populations.

An attacker registers a free subscriber account on a target WordPress site running Fluent Boards Pro 2.0.11 or earlier. They navigate to a board input field - such as a task description or board title - and submit a crafted payload containing a JavaScript snippet designed to exfiltrate the admin's session cookie. When a site administrator later reviews the board content, the injected script executes silently in their browser, forwarding the session cookie to an attacker-controlled endpoint and granting full administrative access to the WordPress installation. No public POC has been identified at time of analysis, but this attack pattern is well-understood and routinely replicated for subscriber-level WordPress XSS findings.