Fluentcommunity
Monthly
Subscriber-level Cross-Site Scripting in FluentCommunity (WordPress plugin) versions up to and including 2.7.5 allows authenticated users with subscriber-level access to inject malicious scripts that execute in the browser context of other users, including administrators. The scope change (S:C in CVSS) indicates the injected payload affects a different security principal than the attacker, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low privilege requirement and network-accessible attack surface make this a realistic threat for multi-user WordPress deployments running community features.
Subscriber-level Cross-Site Scripting in FluentCommunity (WordPress plugin) versions up to and including 2.7.5 allows authenticated users with subscriber-level access to inject malicious scripts that execute in the browser context of other users, including administrators. The scope change (S:C in CVSS) indicates the injected payload affects a different security principal than the attacker, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low privilege requirement and network-accessible attack surface make this a realistic threat for multi-user WordPress deployments running community features.