FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution <= 3.1.7 - Unauthenticated Stored Cross-Site Scripting
high
The FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...
- CVSS:
- 7.2
- Affected:
- up to 3.1.7
- Fixed in:
- 3.1.8
- Disclosed:
- Jul 9, 2026
CVE-2026-57715 on NVD →
FluentCRM <= 2.9.87 - Unauthenticated Blind Server-Side Request Forgery via 'SubscribeURL' Parameter
medium
The FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 2.9.87 via the 'SubscribeURL' parameter. This makes it possible for unauthenticated attackers to m...
- CVSS:
- 5.4
- Affected:
- up to 2.9.87
- Fixed in:
- 3.0.0
- Disclosed:
- May 21, 2026
CVE-2026-7798 on NVD →
FluentCRM - Marketing Automation For WordPress <= 2.9.84 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fluentcrm_content' Shortcode
medium
The FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'fluentcrm_content' shortcode in all versions up to, and including, 2.9.84 due to insufficient input sanitization and output...
- CVSS:
- 6.4
- Affected:
- up to 2.9.84
- Fixed in:
- 2.9.85
- Disclosed:
- Nov 20, 2025
CVE-2025-12935 on NVD →
Fluent CRM <= 2.8.44 - Authenticated (Administrator+) Stored Cross-Site Scripting
medium
The Email Newsletter, Marketing, Email Automation and CRM Plugin for WordPress by FluentCRM plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.8.44 due to insufficient input sanitization and output escaping. This makes it possible for authenticat...
- CVSS:
- 4.4
- Affected:
- up to 2.8.44
- Fixed in:
- 2.8.45
- Disclosed:
- Mar 28, 2024
CVE-2024-30430 on NVD →
FluentCRM - Marketing Automation For WordPress <= 2.8.01 - Insufficient Use of Hash as Authorization Control
medium
The FluentCRM - Marketing Automation For WordPress plugin for WordPress is vulnerable to unauthorized modification of data in versions up to, and including, 2.8.01 due to the use of an MD5 hash without a salt to control subscriptions. This makes it possible for unauthenticated attackers to unsubscribe users from lists...
- CVSS:
- 6.5
- Affected:
- up to 2.8.0.1
- Fixed in:
- 2.8.02
- Disclosed:
- Jun 1, 2023
CVE-2023-1430 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database