CVE-2025-12935

FluentCRM - Marketing Automation For WordPress <= 2.9.84 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fluentcrm_content' Shortcode

View on CVE.org

Published Nov 21, 2025 CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Description

The FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'fluentcrm_content' shortcode in all versions up to, and including, 2.9.84 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Analysis

Technical impact

The FluentCRM WordPress plugin contains a stored cross‑site scripting vulnerability in the 'fluentcrm_content' shortcode. This is a CWE‑79 vulnerability. Unsanitized, user‑supplied attributes allow an authenticated contributor or higher to embed malicious JavaScript that is stored and executed whenever a page containing the shortcode is viewed.

Affected Systems

WordPress sites running any version of the FluentCRM plugin up to and including 2.9.84. The plugin is made by Techjewel. Users with contributor‑level access or more are required to exploit the flaw.

Risk and Exploitability

The weakness is rated CVSS 6.4 with an EPSS of less than 1 %, and it is not listed in the CISA KEV catalog. Exploitation requires an authenticated user with contributor permissions or higher, who can then store arbitrary scripts that will run for anyone who views the compromised content.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

techjewel

FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution

unaffected

Version	Status	Constraints
`0`	affected	≤ 2.9.84

No data.

Vendor	Product	Versions
Techjewel	Fluentcrm	—
Wordpress	Wordpress	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade FluentCRM to a version newer than 2.9.84 or apply an official vendor patch
If an upgrade cannot be applied immediately, remove or disable the 'fluentcrm_content' shortcode from any pages until a patch is installed
Restrict contributor‑level access or review user roles to limit the number of users who can inject content until the vulnerability is resolved

Generated by OpenCVE AI on April 22, 2026 at 06:04 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.309% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://plugins.trac.wordpress.org/browser/fluent-crm/tags/2.9.84/app/Hooks/Handlers/PrefFormHandler.php#L175
https://plugins.trac.wordpress.org/browser/fluent-crm/tags/2.9.84/app/Hooks/actions.php#L172
https://plugins.trac.wordpress.org/changeset/3399640/
https://www.wordfence.com/threat-intel/vulnerabilities/id/7129e5cb-ce70-477a-a8f1-3acf152dfc21?source=cve

History

Nov 24, 2025 9:15 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Techjewel Techjewel fluentcrm Wordpress Wordpress wordpress
Vendors & Products		Techjewel Techjewel fluentcrm Wordpress Wordpress wordpress

Nov 21, 2025 6:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Nov 21, 2025 12:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'fluentcrm_content' shortcode in all versions up to, and including, 2.9.84 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Title		FluentCRM - Marketing Automation For WordPress <= 2.9.84 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fluentcrm_content' Shortcode
Weaknesses		CWE-79
References		https://plugins.trac.wordpress.org/browser/fluent-crm/tags/2.9.84/app/Hooks/Handlers/PrefFormHandler.php#L175 https://plugins.trac.wordpress.org/browser/fluent-crm/tags/2.9.84/app/Hooks/actions.php#L172 https://plugins.trac.wordpress.org/changeset/3399640/ https://www.wordfence.com/threat-intel/vulnerabilities/id/7129e5cb-ce70-477a-a8f1-3acf152dfc21?source=cve
Metrics		cvssV3_1 `{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'}`