Fluent Crm
Monthly
Privilege escalation in the Fluent CRM WordPress plugin version 3.2.5 and earlier allows an authenticated low-privileged user - such as a subscriber or self-registered account - to elevate their privileges and gain control over site resources, with a CVSS 3.1 score of 8.8 and high impact to confidentiality, integrity, and availability. Exploitation is not anonymous: it requires a valid low-privilege WordPress account plus an active vulnerable plugin installation, but no user interaction is needed (PR:L, UI:N) and no non-default configuration is named in the advisory. No public exploit identified at time of analysis; this is a genuine priority, not a high-CVSS-but-low-real-risk issue.
Reflected cross-site scripting in the WPManageNinja Fluent CRM WordPress plugin (all versions through 3.1.7) lets a remote unauthenticated attacker inject script that executes in a victim's browser when they follow a crafted link. Because the CVSS scope is changed (S:C), successful exploitation can affect resources beyond the vulnerable component, typically hijacking an authenticated WordPress admin session within the wp-admin context. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Missing authorization in FluentCRM through 3.2.6 lets remote, unauthenticated attackers make limited unauthorized modifications on affected WordPress sites; confidentiality and availability are not impacted. The flaw is rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N, C:N/I:L/A:N), and the exact endpoint or action lacking the access-control check is not described in the available sources. No public exploit identified at time of analysis and no CISA KEV entry is provided.
Missing authorization (CWE-862) in the WordPress plugin Fluent CRM through version 3.2.6 lets a low-privilege authenticated user reach functionality or data they should not be permitted to access, with limited confidentiality and integrity impact (CVSS 5.4). Exploitation requires a valid account on the target WordPress site (PR:L) and no user interaction (UI:N), so fully unauthenticated visitors cannot trigger it. No public exploit code and no confirmed active exploitation are indicated in the available sources; the specific endpoint or role boundary crossed is not described in the available sources. This is a moderate, authentication-gated access-control flaw rather than a top-tier emergency, prioritized as this_month.
Privilege escalation in the Fluent CRM WordPress plugin version 3.2.5 and earlier allows an authenticated low-privileged user - such as a subscriber or self-registered account - to elevate their privileges and gain control over site resources, with a CVSS 3.1 score of 8.8 and high impact to confidentiality, integrity, and availability. Exploitation is not anonymous: it requires a valid low-privilege WordPress account plus an active vulnerable plugin installation, but no user interaction is needed (PR:L, UI:N) and no non-default configuration is named in the advisory. No public exploit identified at time of analysis; this is a genuine priority, not a high-CVSS-but-low-real-risk issue.
Reflected cross-site scripting in the WPManageNinja Fluent CRM WordPress plugin (all versions through 3.1.7) lets a remote unauthenticated attacker inject script that executes in a victim's browser when they follow a crafted link. Because the CVSS scope is changed (S:C), successful exploitation can affect resources beyond the vulnerable component, typically hijacking an authenticated WordPress admin session within the wp-admin context. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Missing authorization in FluentCRM through 3.2.6 lets remote, unauthenticated attackers make limited unauthorized modifications on affected WordPress sites; confidentiality and availability are not impacted. The flaw is rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N, C:N/I:L/A:N), and the exact endpoint or action lacking the access-control check is not described in the available sources. No public exploit identified at time of analysis and no CISA KEV entry is provided.
Missing authorization (CWE-862) in the WordPress plugin Fluent CRM through version 3.2.6 lets a low-privilege authenticated user reach functionality or data they should not be permitted to access, with limited confidentiality and integrity impact (CVSS 5.4). Exploitation requires a valid account on the target WordPress site (PR:L) and no user interaction (UI:N), so fully unauthenticated visitors cannot trigger it. No public exploit code and no confirmed active exploitation are indicated in the available sources; the specific endpoint or role boundary crossed is not described in the available sources. This is a moderate, authentication-gated access-control flaw rather than a top-tier emergency, prioritized as this_month.