FluentAuth - Auth Security Plugin <= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fluent_auth_reset_password' Shortcode
medium
The FluentAuth – The Ultimate Authorization & Security Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `fluent_auth_reset_password` shortcode in all versions up to, and including, 2.0.3 due to insufficient input sanitization and output escaping on user supplied at...
- CVSS:
- 6.4
- Affected:
- up to 2.0.3
- Fixed in:
- 2.1.0
- Disclosed:
- Dec 15, 2025
CVE-2025-13728 on NVD →
FluentAuth <= 1.0.1 - IP Spoofing to Protection Mechanism Bypass
medium
The FluentAuth plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 1.0.1. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supply the X-Forwarded-For header with with a differ...
- CVSS:
- 6.5
- Affected:
- up to 1.0.1
- Fixed in:
- 1.0.2
- Disclosed:
- Dec 27, 2022
CVE-2022-4746 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database