Fluent Forms Pro Add On Pack
Monthly
Unauthenticated cross-site scripting in the Fluent Forms Pro Add-On Pack WordPress plugin (versions 6.2.13 and earlier) lets a remote attacker supply script payloads that execute in the browser of any user who renders the affected content, most significantly a logged-in administrator reviewing form submissions or an affected page. Rated CVSS 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), the flaw needs no attacker-side credentials but does require victim interaction to fire. No public exploit code and no CISA KEV entry were identified at time of analysis, and the advisory does not name the exact vulnerable parameter or feature.
Subscriber-level privilege escalation in Fluent Forms Pro Add On Pack (versions <= 6.2.12) allows authenticated users with minimal access to gain significantly elevated permissions within a WordPress installation. Reported by Patchstack against the wp_manage_ninja plugin, the flaw stems from incorrect privilege assignment (CWE-266), meaning subscriber-role accounts can trigger functionality reserved for higher-privileged roles such as administrators. No public exploit or CISA KEV listing has been identified at time of analysis, though the network-accessible attack vector and high CVSS impact across confidentiality, integrity, and availability make this a meaningful risk for any WordPress site accepting subscriber registrations.
Broken access control in Fluent Forms Pro Add On Pack (versions 6.2.12 and earlier) exposes privileged plugin functionality to unauthenticated remote attackers, allowing unauthorized integrity-impacting actions without any credentials or user interaction. The CVSS 3.1 score of 7.5 (High) reflects a network-accessible, low-complexity attack path confirmed by Patchstack, the reporting vendor. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the PR:N/AC:L combination makes this theoretically automatable at scale.
Unauthenticated cross-site scripting in Fluent Forms Pro Add On Pack (versions below 6.2.12) allows a remote, unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by enticing them to interact with a crafted URL or form input. The vulnerability carries a CVSS 7.1 (High) rating with scope-changed impact, meaning the injected script can affect browser context beyond the plugin itself - enabling session hijacking, credential theft, or UI redirection against authenticated WordPress users. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available at version 6.2.12.
An authenticated PHP Object Injection vulnerability in the Fluent Forms Pro Add On Pack plugin for WordPress (versions ≤6.2.6) allows a user with Subscriber-level privileges to inject a malicious serialized PHP object via deserialization of untrusted input. If a suitable POP chain is present and the user update integration is enabled with a mapped user meta field, the attacker can change user passwords and ultimately take over administrator accounts. Public exploit code is available, but the EPSS score (0.38%) suggests low real-world exploitation probability and the vulnerability is not listed in CISA's KEV.
Missing authorization checks in the Fluent Forms Pro Add On Pack for WordPress, affecting versions up to and including 6.2.13, allow unauthenticated remote attackers to reach functionality that should require elevated permissions, yielding a low-integrity impact (vendor/NVD CVSS 3.1 base score 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). Because the vector is PR:N/UI:N, no login and no victim interaction are required; the practical exposure is limited to incorrect modification of plugin-controlled data, with no confidentiality or availability impact assessed. Only sites that have purchased and activated this paid add-on are affected - installations running the free Fluent Forms base plugin alone are not vulnerable. At time of analysis there is no CISA KEV entry and no public exploit identified, and no EPSS score was supplied.
Unauthenticated cross-site scripting in the Fluent Forms Pro Add-On Pack WordPress plugin (versions 6.2.13 and earlier) lets a remote attacker supply script payloads that execute in the browser of any user who renders the affected content, most significantly a logged-in administrator reviewing form submissions or an affected page. Rated CVSS 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), the flaw needs no attacker-side credentials but does require victim interaction to fire. No public exploit code and no CISA KEV entry were identified at time of analysis, and the advisory does not name the exact vulnerable parameter or feature.
Subscriber-level privilege escalation in Fluent Forms Pro Add On Pack (versions <= 6.2.12) allows authenticated users with minimal access to gain significantly elevated permissions within a WordPress installation. Reported by Patchstack against the wp_manage_ninja plugin, the flaw stems from incorrect privilege assignment (CWE-266), meaning subscriber-role accounts can trigger functionality reserved for higher-privileged roles such as administrators. No public exploit or CISA KEV listing has been identified at time of analysis, though the network-accessible attack vector and high CVSS impact across confidentiality, integrity, and availability make this a meaningful risk for any WordPress site accepting subscriber registrations.
Broken access control in Fluent Forms Pro Add On Pack (versions 6.2.12 and earlier) exposes privileged plugin functionality to unauthenticated remote attackers, allowing unauthorized integrity-impacting actions without any credentials or user interaction. The CVSS 3.1 score of 7.5 (High) reflects a network-accessible, low-complexity attack path confirmed by Patchstack, the reporting vendor. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the PR:N/AC:L combination makes this theoretically automatable at scale.
Unauthenticated cross-site scripting in Fluent Forms Pro Add On Pack (versions below 6.2.12) allows a remote, unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by enticing them to interact with a crafted URL or form input. The vulnerability carries a CVSS 7.1 (High) rating with scope-changed impact, meaning the injected script can affect browser context beyond the plugin itself - enabling session hijacking, credential theft, or UI redirection against authenticated WordPress users. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available at version 6.2.12.
An authenticated PHP Object Injection vulnerability in the Fluent Forms Pro Add On Pack plugin for WordPress (versions ≤6.2.6) allows a user with Subscriber-level privileges to inject a malicious serialized PHP object via deserialization of untrusted input. If a suitable POP chain is present and the user update integration is enabled with a mapped user meta field, the attacker can change user passwords and ultimately take over administrator accounts. Public exploit code is available, but the EPSS score (0.38%) suggests low real-world exploitation probability and the vulnerability is not listed in CISA's KEV.
Missing authorization checks in the Fluent Forms Pro Add On Pack for WordPress, affecting versions up to and including 6.2.13, allow unauthenticated remote attackers to reach functionality that should require elevated permissions, yielding a low-integrity impact (vendor/NVD CVSS 3.1 base score 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). Because the vector is PR:N/UI:N, no login and no victim interaction are required; the practical exposure is limited to incorrect modification of plugin-controlled data, with no confidentiality or availability impact assessed. Only sites that have purchased and activated this paid add-on are affected - installations running the free Fluent Forms base plugin alone are not vulnerable. At time of analysis there is no CISA KEV entry and no public exploit identified, and no EPSS score was supplied.