Description
The FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'fluentcrm_content' shortcode in all versions up to, and including, 2.9.84 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Published: 2025-11-21
Score: 6.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Stored Cross‑Site Scripting
Action: Immediate Patch
AI Analysis

Impact

The FluentCRM WordPress plugin contains a stored cross‑site scripting vulnerability in the 'fluentcrm_content' shortcode. This is a CWE‑79 vulnerability. Unsanitized, user‑supplied attributes allow an authenticated contributor or higher to embed malicious JavaScript that is stored and executed whenever a page containing the shortcode is viewed.

Affected Systems

WordPress sites running any version of the FluentCRM plugin up to and including 2.9.84. The plugin is made by Techjewel. Users with contributor‑level access or more are required to exploit the flaw.

Risk and Exploitability

The weakness is rated CVSS 6.4 with an EPSS of less than 1 %, and it is not listed in the CISA KEV catalog. Exploitation requires an authenticated user with contributor permissions or higher, who can then store arbitrary scripts that will run for anyone who views the compromised content.

Generated by OpenCVE AI on April 22, 2026 at 06:04 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade FluentCRM to a version newer than 2.9.84 or apply an official vendor patch
  • If an upgrade cannot be applied immediately, remove or disable the 'fluentcrm_content' shortcode from any pages until a patch is installed
  • Restrict contributor‑level access or review user roles to limit the number of users who can inject content until the vulnerability is resolved

Generated by OpenCVE AI on April 22, 2026 at 06:04 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 24 Nov 2025 09:15:00 +0000

Type Values Removed Values Added
First Time appeared Techjewel
Techjewel fluentcrm
Wordpress
Wordpress wordpress
Vendors & Products Techjewel
Techjewel fluentcrm
Wordpress
Wordpress wordpress

Fri, 21 Nov 2025 18:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 21 Nov 2025 12:45:00 +0000

Type Values Removed Values Added
Description The FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'fluentcrm_content' shortcode in all versions up to, and including, 2.9.84 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Title FluentCRM - Marketing Automation For WordPress <= 2.9.84 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fluentcrm_content' Shortcode
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'}

Subscriptions

Techjewel Fluentcrm
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-04-08T17:00:32.098Z

Reserved: 2025-11-09T22:17:40.122Z

Link: CVE-2025-12935

cve-icon Vulnrichment

Updated: 2025-11-21T17:42:56.888Z

cve-icon NVD

Status : Deferred

Published: 2025-11-21T13:15:45.850

Modified: 2026-04-15T00:35:42.020

Link: CVE-2025-12935

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-22T06:15:10Z

Weaknesses