Wp Manageninja Llc
Monthly
SQL injection in FluentCRM Pro (WordPress plugin, versions ≤ 3.1.12) allows network-accessible, high-privileged authenticated users to inject arbitrary SQL via the Author parameter, compromising full database confidentiality. The CVSS scope change (S:C) with C:H indicates successful exploitation extends read access well beyond the plugin's own tables - potentially exposing CRM contact records, campaign data, and WordPress user credential hashes stored in the underlying MySQL/MariaDB database. No public exploit code has been identified and this CVE is not listed in CISA KEV at time of analysis.
Missing authorization checks in the Fluent Forms Pro Add On Pack for WordPress, affecting versions up to and including 6.2.13, allow unauthenticated remote attackers to reach functionality that should require elevated permissions, yielding a low-integrity impact (vendor/NVD CVSS 3.1 base score 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). Because the vector is PR:N/UI:N, no login and no victim interaction are required; the practical exposure is limited to incorrect modification of plugin-controlled data, with no confidentiality or availability impact assessed. Only sites that have purchased and activated this paid add-on are affected - installations running the free Fluent Forms base plugin alone are not vulnerable. At time of analysis there is no CISA KEV entry and no public exploit identified, and no EPSS score was supplied.
Stored cross-site scripting (XSS) in the FluentForm WordPress plugin (versions through 6.2.14) allows authenticated attackers with low privileges to inject malicious scripts into form fields, which execute when other users view the affected page. Exploitation requires victim interaction and a low-privileged WordPress account, limiting the attack to authenticated scenarios. No public exploit code has been identified, and the risk is considered moderate due to these prerequisites.
FluentForm WordPress plugin versions through 6.2.14 allow a remote, unauthenticated attacker to remove or alter intended client-side form functionality due to an incorrect behavior order flaw (CWE-696). The assessed impact is limited to integrity of client-side behavior (I:L) with no data disclosure, server compromise, or availability loss, and no public exploit or active exploitation has been identified at time of analysis.
Unauthenticated remote attackers can spoof identities and potentially take over accounts on WordPress sites running the FluentAuth (fluent-security) plugin through version 2.1.2 due to insufficient verification of data authenticity (CWE-345). The vendor CVSS 3.1 base score is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), which reflects a remotely reachable, low-complexity integrity flaw with limited impact, but our assessment raises the integrity impact to High (I:H) given the authentication bypass to account takeover described in the advisory. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, yet the flaw requires no authentication, user interaction, or special conditions beyond an internet-reachable install with the vulnerable plugin active.
Cross-Site Request Forgery in Fluent Support Pro WordPress plugin (all versions up to and including 2.3.1) enables an unauthenticated attacker to perform unauthorized state-changing actions by tricking an authenticated plugin user into visiting a crafted page. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms the attack is network-delivered with no attacker privilege requirement, but is gated entirely on victim interaction - limiting mass exploitation. No public exploit or CISA KEV listing has been identified at time of analysis, and EPSS data was not provided.
Insecure Direct Object Reference (IDOR) in Fluent Boards Pro versions up to and including 2.0.11 exposes protected board or task objects to unauthorized access via manipulated object identifiers. The vulnerability is classified under CWE-639 and reported by Patchstack with a Medium CVSS score of 5.3. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the network-accessible attack vector and absence of complexity requirements lower the bar for discovery and abuse.
Server-Side Request Forgery in FluentCRM Pro (WordPress plugin by WP Manage Ninja LLC) versions up to and including 3.1.12 allows low-privileged authenticated users holding the subscriber role to induce the WordPress server to make outbound HTTP requests to arbitrary internal or external destinations. The scope-changed CVSS vector (S:C) confirms the vulnerability can pivot beyond the WordPress application boundary to reach internal network services not otherwise exposed. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS data was not supplied.
Broken access control in Fluent Support Pro (WordPress plugin by WP ManageNinja LLC) versions up to and including 2.3.1 permits subscriber-level authenticated users to perform actions restricted to higher-privileged roles. Rooted in CWE-862 (Missing Authorization), the flaw allows the lowest standard WordPress user role - subscribers, often self-registered customers - to invoke plugin functionality without the authorization checks that should gate those actions, resulting in limited confidentiality and integrity impact against support ticket data. No public exploit code and no active exploitation confirmed by CISA KEV have been identified at time of analysis.
SQL injection in FluentCRM Pro (WordPress plugin, versions ≤ 3.1.12) allows network-accessible, high-privileged authenticated users to inject arbitrary SQL via the Author parameter, compromising full database confidentiality. The CVSS scope change (S:C) with C:H indicates successful exploitation extends read access well beyond the plugin's own tables - potentially exposing CRM contact records, campaign data, and WordPress user credential hashes stored in the underlying MySQL/MariaDB database. No public exploit code has been identified and this CVE is not listed in CISA KEV at time of analysis.
Missing authorization checks in the Fluent Forms Pro Add On Pack for WordPress, affecting versions up to and including 6.2.13, allow unauthenticated remote attackers to reach functionality that should require elevated permissions, yielding a low-integrity impact (vendor/NVD CVSS 3.1 base score 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). Because the vector is PR:N/UI:N, no login and no victim interaction are required; the practical exposure is limited to incorrect modification of plugin-controlled data, with no confidentiality or availability impact assessed. Only sites that have purchased and activated this paid add-on are affected - installations running the free Fluent Forms base plugin alone are not vulnerable. At time of analysis there is no CISA KEV entry and no public exploit identified, and no EPSS score was supplied.
Stored cross-site scripting (XSS) in the FluentForm WordPress plugin (versions through 6.2.14) allows authenticated attackers with low privileges to inject malicious scripts into form fields, which execute when other users view the affected page. Exploitation requires victim interaction and a low-privileged WordPress account, limiting the attack to authenticated scenarios. No public exploit code has been identified, and the risk is considered moderate due to these prerequisites.
FluentForm WordPress plugin versions through 6.2.14 allow a remote, unauthenticated attacker to remove or alter intended client-side form functionality due to an incorrect behavior order flaw (CWE-696). The assessed impact is limited to integrity of client-side behavior (I:L) with no data disclosure, server compromise, or availability loss, and no public exploit or active exploitation has been identified at time of analysis.
Unauthenticated remote attackers can spoof identities and potentially take over accounts on WordPress sites running the FluentAuth (fluent-security) plugin through version 2.1.2 due to insufficient verification of data authenticity (CWE-345). The vendor CVSS 3.1 base score is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), which reflects a remotely reachable, low-complexity integrity flaw with limited impact, but our assessment raises the integrity impact to High (I:H) given the authentication bypass to account takeover described in the advisory. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, yet the flaw requires no authentication, user interaction, or special conditions beyond an internet-reachable install with the vulnerable plugin active.
Cross-Site Request Forgery in Fluent Support Pro WordPress plugin (all versions up to and including 2.3.1) enables an unauthenticated attacker to perform unauthorized state-changing actions by tricking an authenticated plugin user into visiting a crafted page. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms the attack is network-delivered with no attacker privilege requirement, but is gated entirely on victim interaction - limiting mass exploitation. No public exploit or CISA KEV listing has been identified at time of analysis, and EPSS data was not provided.
Insecure Direct Object Reference (IDOR) in Fluent Boards Pro versions up to and including 2.0.11 exposes protected board or task objects to unauthorized access via manipulated object identifiers. The vulnerability is classified under CWE-639 and reported by Patchstack with a Medium CVSS score of 5.3. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the network-accessible attack vector and absence of complexity requirements lower the bar for discovery and abuse.
Server-Side Request Forgery in FluentCRM Pro (WordPress plugin by WP Manage Ninja LLC) versions up to and including 3.1.12 allows low-privileged authenticated users holding the subscriber role to induce the WordPress server to make outbound HTTP requests to arbitrary internal or external destinations. The scope-changed CVSS vector (S:C) confirms the vulnerability can pivot beyond the WordPress application boundary to reach internal network services not otherwise exposed. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS data was not supplied.
Broken access control in Fluent Support Pro (WordPress plugin by WP ManageNinja LLC) versions up to and including 2.3.1 permits subscriber-level authenticated users to perform actions restricted to higher-privileged roles. Rooted in CWE-862 (Missing Authorization), the flaw allows the lowest standard WordPress user role - subscribers, often self-registered customers - to invoke plugin functionality without the authorization checks that should gate those actions, resulting in limited confidentiality and integrity impact against support ticket data. No public exploit code and no active exploitation confirmed by CISA KEV have been identified at time of analysis.