Vulnerabilidades de WP ManageNinja LLC

CVE-2026-78274 Crítica · 9.1 CWE-434 27/08/2026

WordPress Fluent Boards Pro plugin <= 2.0.11 - Arbitrary File Upload vulnerability

Editor Arbitrary File Upload in Fluent Boards Pro <= 2.0.11 versions.

CVE-2026-78273 Média · 6.5 CWE-79 27/08/2026

WordPress Fluent Boards Pro plugin <= 2.0.11 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting (XSS) in Fluent Boards Pro <= 2.0.11 versions.

CVE-2026-78271 Alta · 7.2 CWE-266 27/08/2026

WordPress FluentCRM Pro plugin <= 3.1.12 - Privilege Escalation vulnerability

Editor Privilege Escalation in FluentCRM Pro <= 3.1.12 versions.

CVE-2026-78279 Média · 5.4 CWE-352 24/08/2026

WordPress Fluent Support Pro plugin <= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in Fluent Support Pro <= 2.3.1 versions.

CVE-2026-78278 Média · 5.3 CWE-639 24/08/2026

WordPress Fluent Boards Pro plugin <= 2.0.11 - Insecure Direct Object References (IDOR) vulnerability

Subscriber Insecure Direct Object References (IDOR) in Fluent Boards Pro <= 2.0.11 versions.

CVE-2026-78277 Média · 4.9 CWE-918 24/08/2026

WordPress FluentCRM Pro plugin <= 3.1.12 - Server Side Request Forgery (SSRF) vulnerability

Subscriber Server Side Request Forgery (SSRF) in FluentCRM Pro <= 3.1.12 versions.

CVE-2026-78272 Média · 5.4 CWE-862 24/08/2026

WordPress Fluent Support Pro plugin <= 2.3.1 - Broken Access Control vulnerability

Subscriber Broken Access Control in Fluent Support Pro <= 2.3.1 versions.

CVE-2026-78270 Alta · 7.6 CWE-89 24/08/2026

WordPress FluentCRM Pro plugin <= 3.1.12 - SQL Injection vulnerability

Author SQL Injection in FluentCRM Pro <= 3.1.12 versions.

CVE-2026-66633 Alta · 7.1 CWE-79 18/08/2026

WordPress Fluent Forms Pro Add On Pack plugin < 6.2.12 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack < 6.2.12 versions.

CVE-2026-73533 Crítica · 9.8 CWE-506 13/08/2026

Ninja Tables Pro 5.2.11 Embedded Malicious Code via Tampered Plugin Build

Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file (app/Library/updater/NinjaTableDataSync.php) that established a backdoor REST API endpoint, dropped persistent PHP files in mu-plugins and uploads directories, installed a passwordless administrator account, and registered scheduled tasks that survived plugin removal.

CVE-2026-73532 Crítica · 9.8 CWE-506 13/08/2026

Fluent Forms Pro 6.2.7 Embedded Malicious Code via Tampered Plugin Build

Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file (libs/class-license-sync.php), loaded via a require_once directive added to fluentformpro.php, that established a backdoor REST API endpoint, dropped persistent PHP files in mu-plugins and uploads directories, installed a passwordless administrator account, and registered scheduled tasks that survived plugin removal.

CVE-2026-66467 Média · 6.5 CWE-79 13/08/2026

WordPress FluentCommunity plugin <= 2.7.5 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting (XSS) in FluentCommunity <= 2.7.5 versions.

CVE-2026-18146 Alta · 7.2 CWE-79 13/08/2026

Fluent Forms <= 6.2.11 - Unauthenticated Stored Cross-Site Scripting via Notification Smartcode Values

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Notification Smartcode Values in all versions up to, and including, 6.2.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in the browser of an administrator (or any user with the Fluent Forms entry-viewing capability) when they view the form's entry Submission Logs in the WordPress admin dashboard. Exploitation requires that a site administrator or Fluent Forms manager has configured an email notification whose subject or static (direct) Send To value references an attacker-influenced Smartcode such as an input_password field value, a cookie value, or submission.response.

CVE-2026-61964 Alta · 7.1 CWE-79 06/08/2026

WordPress Ninja Tables plugin <= 5.2.9 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Ninja Tables <= 5.2.9 versions.

CVE-2026-16636 Alta · 7.2 CWE-79 06/08/2026

FluentSMTP <= 2.2.95 - Unauthenticated Stored Cross-Site Scripting via Recipient Display Name (to.name) in Email Logs

The FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Recipient Display Name (to.name) in Email Logs in all versions up to, and including, 2.2.95 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is delivered via an attacker-controlled recipient display name (to.name) in a wp_mail() call and does not fire in the log list view — only in the detail view when an administrator uses the Prev/Next navigation controls, as that path bypasses the escapeHtml pipeline used by the list view.

CVE-2026-17571 Média · 6.1 CWE-79 01/08/2026

Fluent Forms <= 6.2.8 - Reflected Cross-Site Scripting via 'param'

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'param' in all versions up to, and including, 6.2.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

CVE-2026-17567 Média · 5.3 CWE-639 31/07/2026

Fluent Forms <= 6.2.8 - Unauthenticated Sensitive Information Exposure via Insecure Direct Object Reference and Weak Transaction Hash in 'transaction' Parameter

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.2.8 via the 'transaction' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to brute-force valid transaction hashes and view sensitive payment receipt data including customer name, email address, billing address, order items, payment method, and payment status belonging to other users. Because submission ID, form ID, and transaction creation time are either observable or guessable by an attacker, the effective brute-force space is bounded to approximately 900 candidates per second per (submission, form) pair, making exploitation practical without any prior authentication or account.

CVE-2026-16655 Alta · 7.2 CWE-79 29/07/2026

Fluent Forms <= 6.2.7 - Unauthenticated Stored Cross-Site Scripting via Name Field Nested `password` Member

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Name Field Nested `password` Member in all versions up to, and including, 6.2.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVE-2026-15665 Média · 6.4 CWE-79 24/07/2026

Fluent Support <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'redirect-to' Shortcode Attribute

The Fluent Support – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'redirect-to' Shortcode Attribute in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The XSS payload is in a hidden attribute so it only fires in specific browsers when specific access keys are used making exploitation unlikely.

CVE-2026-65474 Média · 5.3 CWE-497 23/07/2026

WordPress Ninja Tables plugin <= 5.2.10 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Ninja Tables <= 5.2.10 versions.

CVE-2026-65470 Média · 6.5 CWE-79 23/07/2026

WordPress Fluent Support plugin <= 2.3.0 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Fluent Support <= 2.3.0 versions.

CVE-2026-57715 Alta · 7.1 CWE-79 13/07/2026

WordPress Fluent CRM plugin <= 3.1.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPManageNinja Fluent CRM fluent-crm allows Reflected XSS.This issue affects Fluent CRM: from n/a through <= 3.1.7.

CVE-2026-5069 Média · 5.4 CWE-863 10/07/2026

Fluent Forms <= 6.2.1 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Subscription Cancellation via 'subscription_id'

The Fluent Forms plugin for WordPress is vulnerable to incorrect authorization via the 'subscription_id' parameter in versions up to, and including, 6.2.1. This is due to insufficient ownership authorization checks in the payment cancellation AJAX flow. This makes it possible for authenticated attackers, with subscriber-level access and above, to submit cancellation requests for other users' subscriptions.

CVE-2026-57638 Média · 6.5 CWE-79 26/06/2026

WordPress Fluent Booking plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Fluent Booking <= 2.1.0 versions.

CVE-2026-42655 Média · 5.9 CWE-472 15/06/2026

WordPress Best Payments Plugin for WP plugin <= 4.6.19 - Payment Bypass vulnerability

Unauthenticated Bypass Vulnerability in Best Payments Plugin for WP <= 4.6.19 versions.