WP ManageNinja LLC vulnerabilities
Published CVEs affecting WP ManageNinja LLC products: 50 record(s), with severity, exploitation and fixes.
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder 7Fluent Boards Pro 5Fluent Forms Pro Add On Pack 4FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler 3FluentBooking Pro 3FluentCRM Pro 3Fluent CRM 3FluentForm 2FluentCart 2Ninja Tables 2Fluent Support 2Fluent Support Pro 2Best Payments Plugin for WP 2Fluent Affiliate Pro 1Fluent Booking 1FluentBoards 1Fluent Support – Helpdesk & Customer Support Ticket System 1FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, Mailgun, Postmark, Cloudflare, toSend, Gmail and Any SMTP 1FluentCommunity 1Fluent Forms Pro 1Ninja Tables Pro 1FluentPlayer Pro 1FluentAuth 1
CVE-2026-103525
High · 7.5
CWE-639 Oct 16, 2026
FluentCart A New Era of eCommerce <= 1.7.0 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'order_id' and 'billing_address_id' Parameters
The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.7.0 via the 'order_id + billing_address_id (also shipping_address_id)' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to read and exfiltrate another customer's stored billing and shipping address PII — including street address, city, state, postcode, phone number, company name, VAT number, and legal registration ID — by enumerating sequential AUTO_INCREMENT order and address ID pairs. The id-equality guard intended to restrict address reuse is bypassed because the attacker controls both halves of the compared pair, and the unauthenticated AJAX entry point imposes only a soft rate limit of 5 requests per 60 seconds rather than any authentication or ownership check.
CVE-2026-103518
Medium · 4.9
CWE-89 Oct 16, 2026
FluentCart A New Era of eCommerce <= 1.7.0 - Authenticated (Administrator+) SQL Injection via 'products.variants' Array Keys
The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to generic SQL Injection via the 'products[*].variants[*].<attacker-chosen key>' parameter in all versions up to, and including, 1.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. On FluentCart Pro installs, non-administrator users assigned the Manager shop role also hold the products/edit permission and are therefore able to exploit this vulnerability without administrator-level access.
CVE-2026-109693
High · 8.8
CWE-266 Oct 15, 2026
WordPress Fluent CRM plugin <= 3.2.5 - Privilege Escalation vulnerability
Incorrect Privilege Assignment vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Privilege Escalation.This issue affects Fluent CRM: from n/a through 3.2.5.
CVE-2026-109695
High · 7.5
CWE-201 Oct 15, 2026
WordPress FluentCart plugin <= 1.7.1 - Sensitive Data Exposure vulnerability
Insertion of Sensitive Information Into Sent Data vulnerability in WPManageNinja FluentCart fluent-cart allows Retrieve Embedded Sensitive Data.This issue affects FluentCart: from n/a through 1.7.1.
CVE-2026-109694
Critical · 9.8
CWE-266 Oct 15, 2026
WordPress Fluent CRM plugin <= 3.2.5 - Privilege Escalation vulnerability
Incorrect Privilege Assignment vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Privilege Escalation.This issue affects Fluent CRM: from n/a through 3.2.5.
CVE-2026-108484
High · 7.1
CWE-79 Oct 14, 2026
WordPress Best Payments Plugin for WP plugin <= 4.6.27 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPManageNinja Best Payments Plugin for WP wp-payment-form allows Stored XSS.This issue affects Best Payments Plugin for WP: from n/a through 4.6.27.
CVE-2026-109696
Medium · 5.4
CWE-862 Oct 13, 2026
WordPress FluentBoards plugin <= 2.1.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in WP ManageNinja LLC FluentBoards fluent-boards allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentBoards: from n/a through 2.1.0.
CVE-2026-15178
Medium · 5.4
CWE-862 Oct 10, 2026
Fluent Forms <= 6.2.5 - Missing Authorization to Authenticated (Custom+) Sensitive Data Exposure and Modification
The Fluent Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.2.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Custom-level access and above, to read private form submissions, change submission statuses, permanently delete submissions, and modify global plugin settings.
CVE-2026-101324
Medium · 4.7
CWE-79 Oct 10, 2026
Fluent Forms <= 6.2.14 - Reflected Cross-Site Scripting via '{get.*}' Editor SmartCode Parameter
The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'any attacker-chosen name matching the {get.NAME} placeholder (PoC uses 'proof')' parameter in all versions up to, and including, 6.2.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires a site administrator to have configured a Custom HTML field on a published form containing a {get.*} SmartCode inside a URL-accepting attribute such as iframe src or a href — a documented Fluent Forms feature.
CVE-2026-39789
High · 7.5
CWE-862 Oct 6, 2026
WordPress Fluent Affiliate Pro plugin <= 1.6.4 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Fluent Affiliate Pro <= 1.6.4 versions.
CVE-2026-105072
High · 7.5
CWE-862 Oct 6, 2026
WordPress FluentBooking Pro plugin < 2.5.0 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in FluentBooking Pro < 2.5.0 versions.
CVE-2026-94669
Medium · 5.3
CWE-862 Oct 5, 2026
WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.13 - Broken Access Control vulnerability
Missing Authorization vulnerability in WP ManageNinja LLC Fluent Forms Pro Add On Pack fluentformpro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fluent Forms Pro Add On Pack: from n/a through 6.2.13.
CVE-2026-103343
Medium · 6.5
CWE-79 Oct 1, 2026
WordPress FluentForm plugin <= 6.2.14 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP ManageNinja LLC FluentForm fluentform allows Stored XSS.This issue affects FluentForm: from n/a through 6.2.14.
CVE-2026-103353
Medium · 5.3
CWE-696 Oct 1, 2026
WordPress FluentForm plugin <= 6.2.14 - Broken Access Control vulnerability
Incorrect Behavior Order vulnerability in WP ManageNinja LLC FluentForm fluentform allows Removing Important Client Functionality.This issue affects FluentForm: from n/a through 6.2.14.
CVE-2026-94679
Medium · 5.4
CWE-862 Sep 23, 2026
WordPress Fluent Support plugin <= 2.3.2 - Broken Access Control vulnerability
Subscriber Broken Access Control in Fluent Support <= 2.3.2 versions.
CVE-2026-78296
Medium · 5.3
CWE-345 Sep 17, 2026
WordPress FluentAuth plugin <= 2.1.2 - Email Verification Bypass vulnerability
Insufficient Verification of Data Authenticity vulnerability in WP ManageNinja LLC FluentAuth allows Identity Spoofing.
This issue affects FluentAuth: from n/a through 2.1.2.
CVE-2026-84766
Medium · 5.9
CWE-290 Sep 3, 2026
WordPress FluentBooking Pro plugin <= 2.2.1 - Bypass Vulnerability vulnerability
Unauthenticated Bypass Vulnerability in FluentBooking Pro <= 2.2.1 versions.
CVE-2026-81297
High · 7.5
CWE-266 Aug 31, 2026
WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.12 - Privilege Escalation vulnerability
Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack <= 6.2.12 versions.
CVE-2026-81296
High · 7.5
CWE-862 Aug 31, 2026
WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.12 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack <= 6.2.12 versions.
CVE-2026-81273
High · 8.1
CWE-352 Aug 27, 2026
WordPress FluentBooking Pro plugin <= 2.2.4 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery (CSRF) in FluentBooking Pro <= 2.2.4 versions.
CVE-2026-81272
Medium · 4.9
CWE-862 Aug 27, 2026
WordPress FluentPlayer Pro plugin <= 1.3.2 - Broken Access Control vulnerability
Editor Broken Access Control in FluentPlayer Pro <= 1.3.2 versions.
CVE-2026-78276
High · 7.2
CWE-502 Aug 27, 2026
WordPress Fluent Boards Pro plugin <= 2.0.11 - PHP Object Injection vulnerability
Editor PHP Object Injection in Fluent Boards Pro <= 2.0.11 versions.
CVE-2026-78275
Medium · 6.8
CWE-22 Aug 27, 2026
WordPress Fluent Boards Pro plugin <= 2.0.11 - Arbitrary File Deletion vulnerability
Editor Arbitrary File Deletion in Fluent Boards Pro <= 2.0.11 versions.
CVE-2026-78274
Critical · 9.1
CWE-434 Aug 27, 2026
WordPress Fluent Boards Pro plugin <= 2.0.11 - Arbitrary File Upload vulnerability
Editor Arbitrary File Upload in Fluent Boards Pro <= 2.0.11 versions.
CVE-2026-78273
Medium · 6.5
CWE-79 Aug 27, 2026
WordPress Fluent Boards Pro plugin <= 2.0.11 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting (XSS) in Fluent Boards Pro <= 2.0.11 versions.