Fluentcommunity
Monthly
Missing authorization in the FluentCommunity WordPress plugin (all versions through 2.11.0) lets an authenticated low-privileged member - for example a self-registered community user on a site with open registration - reach functionality that should be gated behind stricter access controls, resulting in limited information disclosure only (CVSS 4.3, C:L/I:N/A:N). The defect is a CWE-862 missing authorization check that is network-reachable, low-complexity and requires no user interaction, but its moderate rating reflects the prerequisite of an existing account. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Subscriber-level Cross-Site Scripting in FluentCommunity (WordPress plugin) versions up to and including 2.7.5 allows authenticated users with subscriber-level access to inject malicious scripts that execute in the browser context of other users, including administrators. The scope change (S:C in CVSS) indicates the injected payload affects a different security principal than the attacker, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low privilege requirement and network-accessible attack surface make this a realistic threat for multi-user WordPress deployments running community features.
Missing authorization in the FluentCommunity WordPress plugin (all versions through 2.11.0) lets an authenticated low-privileged member - for example a self-registered community user on a site with open registration - reach functionality that should be gated behind stricter access controls, resulting in limited information disclosure only (CVSS 4.3, C:L/I:N/A:N). The defect is a CWE-862 missing authorization check that is network-reachable, low-complexity and requires no user interaction, but its moderate rating reflects the prerequisite of an existing account. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Subscriber-level Cross-Site Scripting in FluentCommunity (WordPress plugin) versions up to and including 2.7.5 allows authenticated users with subscriber-level access to inject malicious scripts that execute in the browser context of other users, including administrators. The scope change (S:C in CVSS) indicates the injected payload affects a different security principal than the attacker, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low privilege requirement and network-accessible attack surface make this a realistic threat for multi-user WordPress deployments running community features.