Fluentcrm
Monthly
SQL injection in the FluentCRM Pro WordPress plugin (all versions up to and including 3.1.12) enables authenticated attackers holding Author-level access or higher to append arbitrary SQL to existing queries and extract sensitive data from the WordPress database. Reported by Wordfence, the flaw stems from unsanitized user-supplied parameters passed into unparameterized SQL queries. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high-confidentiality CVSS rating reflects meaningful exposure of subscriber lists, CRM data, and potentially credential material stored in the database.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Email Newsletter Team - FluentCRM Fluent CRM allows Stored XSS.8.44. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The FluentCRM - Marketing Automation For WordPress plugin for WordPress is vulnerable to unauthorized modification of data in versions up to, and including, 2.8.01 due to the use of an MD5 hash. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
SQL injection in the FluentCRM Pro WordPress plugin (all versions up to and including 3.1.12) enables authenticated attackers holding Author-level access or higher to append arbitrary SQL to existing queries and extract sensitive data from the WordPress database. Reported by Wordfence, the flaw stems from unsanitized user-supplied parameters passed into unparameterized SQL queries. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high-confidentiality CVSS rating reflects meaningful exposure of subscriber lists, CRM data, and potentially credential material stored in the database.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Email Newsletter Team - FluentCRM Fluent CRM allows Stored XSS.8.44. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The FluentCRM - Marketing Automation For WordPress plugin for WordPress is vulnerable to unauthorized modification of data in versions up to, and including, 2.8.01 due to the use of an MD5 hash. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.