5
CVEs
0
Critical
1
High
0
KEV
0
PoC
1
Unpatched C/H
0.0%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
1
MEDIUM
4
LOW
0
Monthly CVE Trend
Affected Products (4)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-78270 | SQL injection in FluentCRM Pro (WordPress plugin, versions ≤ 3.1.12) allows network-accessible, high-privileged authenticated users to inject arbitrary SQL via the Author parameter, compromising full database confidentiality. The CVSS scope change (S:C) with C:H indicates successful exploitation extends read access well beyond the plugin's own tables - potentially exposing CRM contact records, campaign data, and WordPress user credential hashes stored in the underlying MySQL/MariaDB database. No public exploit code has been identified and this CVE is not listed in CISA KEV at time of analysis. | HIGH | 7.6 | 0.2% | 38 |
No patch
|
| CVE-2026-78272 | Broken access control in Fluent Support Pro (WordPress plugin by WP ManageNinja LLC) versions up to and including 2.3.1 permits subscriber-level authenticated users to perform actions restricted to higher-privileged roles. Rooted in CWE-862 (Missing Authorization), the flaw allows the lowest standard WordPress user role - subscribers, often self-registered customers - to invoke plugin functionality without the authorization checks that should gate those actions, resulting in limited confidentiality and integrity impact against support ticket data. No public exploit code and no active exploitation confirmed by CISA KEV have been identified at time of analysis. | MEDIUM | 5.4 | 0.2% | 27 |
No patch
|
| CVE-2026-78279 | Cross-Site Request Forgery in Fluent Support Pro WordPress plugin (all versions up to and including 2.3.1) enables an unauthenticated attacker to perform unauthorized state-changing actions by tricking an authenticated plugin user into visiting a crafted page. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms the attack is network-delivered with no attacker privilege requirement, but is gated entirely on victim interaction - limiting mass exploitation. No public exploit or CISA KEV listing has been identified at time of analysis, and EPSS data was not provided. | MEDIUM | 5.4 | 0.1% | 27 |
No patch
|
| CVE-2026-78278 | Insecure Direct Object Reference (IDOR) in Fluent Boards Pro versions up to and including 2.0.11 exposes protected board or task objects to unauthorized access via manipulated object identifiers. The vulnerability is classified under CWE-639 and reported by Patchstack with a Medium CVSS score of 5.3. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the network-accessible attack vector and absence of complexity requirements lower the bar for discovery and abuse. | MEDIUM | 5.3 | 0.2% | 26 |
No patch
|
| CVE-2026-78277 | Server-Side Request Forgery in FluentCRM Pro (WordPress plugin by WP Manage Ninja LLC) versions up to and including 3.1.12 allows low-privileged authenticated users holding the subscriber role to induce the WordPress server to make outbound HTTP requests to arbitrary internal or external destinations. The scope-changed CVSS vector (S:C) confirms the vulnerability can pivot beyond the WordPress application boundary to reach internal network services not otherwise exposed. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS data was not supplied. | MEDIUM | 4.9 | 0.1% | 24 |
No patch
|