Fluent Boards Pro
Monthly
PHP Object Injection in the Fluent Boards Pro WordPress plugin (versions 2.0.11 and earlier) allows authenticated administrators to pass arbitrary serialized PHP data through the editor component, triggering unsafe deserialization on the server and potentially achieving remote code execution, file writes, or full system compromise. The vulnerability is classified as CWE-502 and carries a CVSS 3.1 score of 7.2 (High), with full Confidentiality, Integrity, and Availability impact. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Arbitrary file deletion in Fluent Boards Pro (WordPress plugin) versions up to and including 2.0.11 allows authenticated Editor-level users to delete files anywhere on the server via path traversal. The changed scope (S:C in the CVSS vector) indicates that deletion can extend to files outside the WordPress installation - including potentially critical OS-level or application files - causing severe availability impact. No public exploit code or CISA KEV listing is identified at time of analysis.
Arbitrary file upload in the Fluent Boards Pro WordPress plugin (versions 2.0.11 and earlier) lets a user holding the Editor role (or higher) upload files of dangerous types, typically leading to web shell placement and remote code execution on the host. The flaw carries a CVSS 9.1 rating driven by a scope-changed, full-CIA-impact chain, but requires an authenticated privileged account. No public exploit or active-exploitation evidence is present in the supplied data; the issue was catalogued by Patchstack.
Stored Cross-Site Scripting in Fluent Boards Pro (WordPress plugin by WP Manage Ninja) versions up to and including 2.0.11 allows a subscriber-level authenticated attacker to inject persistent malicious scripts into board content. Because the scope changes (S:C in the CVSS vector), the injected payload executes in the browser context of other users - most critically administrators - who subsequently view the compromised content, enabling session hijacking or privilege escalation. No public exploit code or active exploitation has been identified at time of analysis, but the low privilege requirement (subscriber account) broadens the realistic attacker population on multi-user WordPress sites.
Insecure Direct Object Reference in Fluent Boards Pro WordPress plugin (all versions through 2.0.11) enables authenticated attackers with Subscriber-level access to perform unauthorized actions by supplying arbitrary user-controlled object keys that the plugin accepts without ownership validation. The CVSS 4.3 Medium rating reflects network accessibility offset by the authentication prerequisite and limited integrity-only impact. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Insecure Direct Object Reference (IDOR) in Fluent Boards Pro versions up to and including 2.0.11 exposes protected board or task objects to unauthorized access via manipulated object identifiers. The vulnerability is classified under CWE-639 and reported by Patchstack with a Medium CVSS score of 5.3. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the network-accessible attack vector and absence of complexity requirements lower the bar for discovery and abuse.
PHP Object Injection in the Fluent Boards Pro WordPress plugin (versions 2.0.11 and earlier) allows authenticated administrators to pass arbitrary serialized PHP data through the editor component, triggering unsafe deserialization on the server and potentially achieving remote code execution, file writes, or full system compromise. The vulnerability is classified as CWE-502 and carries a CVSS 3.1 score of 7.2 (High), with full Confidentiality, Integrity, and Availability impact. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Arbitrary file deletion in Fluent Boards Pro (WordPress plugin) versions up to and including 2.0.11 allows authenticated Editor-level users to delete files anywhere on the server via path traversal. The changed scope (S:C in the CVSS vector) indicates that deletion can extend to files outside the WordPress installation - including potentially critical OS-level or application files - causing severe availability impact. No public exploit code or CISA KEV listing is identified at time of analysis.
Arbitrary file upload in the Fluent Boards Pro WordPress plugin (versions 2.0.11 and earlier) lets a user holding the Editor role (or higher) upload files of dangerous types, typically leading to web shell placement and remote code execution on the host. The flaw carries a CVSS 9.1 rating driven by a scope-changed, full-CIA-impact chain, but requires an authenticated privileged account. No public exploit or active-exploitation evidence is present in the supplied data; the issue was catalogued by Patchstack.
Stored Cross-Site Scripting in Fluent Boards Pro (WordPress plugin by WP Manage Ninja) versions up to and including 2.0.11 allows a subscriber-level authenticated attacker to inject persistent malicious scripts into board content. Because the scope changes (S:C in the CVSS vector), the injected payload executes in the browser context of other users - most critically administrators - who subsequently view the compromised content, enabling session hijacking or privilege escalation. No public exploit code or active exploitation has been identified at time of analysis, but the low privilege requirement (subscriber account) broadens the realistic attacker population on multi-user WordPress sites.
Insecure Direct Object Reference in Fluent Boards Pro WordPress plugin (all versions through 2.0.11) enables authenticated attackers with Subscriber-level access to perform unauthorized actions by supplying arbitrary user-controlled object keys that the plugin accepts without ownership validation. The CVSS 4.3 Medium rating reflects network accessibility offset by the authentication prerequisite and limited integrity-only impact. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Insecure Direct Object Reference (IDOR) in Fluent Boards Pro versions up to and including 2.0.11 exposes protected board or task objects to unauthorized access via manipulated object identifiers. The vulnerability is classified under CWE-639 and reported by Patchstack with a Medium CVSS score of 5.3. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the network-accessible attack vector and absence of complexity requirements lower the bar for discovery and abuse.