Threat database

FluentCart plugin for WordPress versions up to 1.7.0 contains an insecure direct object reference vulnerability. This flaw allows unauthenticated attackers to access other customers' billing and shipping address information by manipulating user-controlled keys in AJAX requests. The vulnerability arises from missing validation on order_id and address_id parameters, enabling enumeration of sequential IDs and bypassing intended access controls. The exposed data includes sensitive personally identifiable information (PII) such as street address, phone number, company name, and VAT number. The vulnerability has a high severity rating with a CVSS score of 7.5.

FluentCart, a WordPress eCommerce plugin, contains an SQL Injection vulnerability in versions up to and including 1.7.0. The flaw arises from improper escaping of user-supplied parameters in SQL queries, allowing authenticated users with custom-level access or higher to append malicious SQL commands. On FluentCart Pro, users with the Manager shop role can exploit this without administrator privileges. The vulnerability has a medium severity with a CVSS score of 4.9 and can lead to unauthorized disclosure of sensitive database information.

CVE-2026-109695 is a vulnerability in WPManageNinja FluentCart versions prior to 1.8.0 that allows insertion of sensitive information into sent data. This flaw enables attackers to retrieve embedded sensitive data without requiring privileges or user interaction. The vulnerability has a high severity rating with a CVSS score of 7.5.

CVE-2026-108484 is a stored cross-site scripting (XSS) vulnerability in the WPManageNinja Best Payments Plugin for WordPress. It affects versions from initial release up to 4.6.27. The vulnerability arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. The CVSS 3.1 base score is 7.1, indicating a high severity with network attack vector, low attack complexity, no privileges required, and user interaction needed. The impact includes potential partial confidentiality, integrity, and availability loss. No patch or remediation information is provided in the available data.

The Fluent Forms plugin for WordPress contains an authorization bypass vulnerability in all versions up to and including 6.2.5. This flaw allows authenticated users with Custom-level access or higher to perform unauthorized actions such as reading private form submissions, changing submission statuses, deleting submissions permanently, and modifying global plugin settings.

The Fluent Forms WordPress plugin up to version 6.2.14 is vulnerable to reflected cross-site scripting (XSS) due to improper input sanitization and output escaping of user-controlled parameters in the {get.*} SmartCode placeholders. An unauthenticated attacker can inject malicious scripts if a site administrator has configured a Custom HTML field with a {get.*} SmartCode inside URL-accepting attributes. Exploitation requires tricking a user into interacting with a crafted link, potentially leading to script execution in the user's browser.

Subscriber Broken Access Control in Fluent Support <= 2.3.2 versions.

Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack < 6.2.12 versions.

Fluent Forms Pro version 6.2.7 contains embedded malicious code introduced via a tampered plugin build distributed through a decommissioned update server. This malicious code adds a rogue PHP file that creates a backdoor REST API endpoint, installs a passwordless administrator account, drops persistent PHP files in critical directories, and registers scheduled tasks that persist even after plugin removal. The vulnerability has a critical CVSS score of 9.3 and allows unauthenticated remote attackers to gain high-impact control over affected systems.

Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file (app/Library/updater/NinjaTableDataSync.php) that established a backdoor REST API endpoint, dropped persistent PHP files in mu-plugins and uploads directories, installed a passwordless administrator account, and registered scheduled tasks that survived plugin removal.

Subscriber Cross Site Scripting (XSS) in FluentCommunity <= 2.7.5 versions.

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Notification Smartcode Values in all versions up to, and including, 6.2.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in the browser of an administrator (or any user with the Fluent Forms entry-viewing capability) when they view the form's entry Submission Logs in the WordPress admin dashboard. Exploitation requires that a site administrator or Fluent Forms manager has configured an email notification whose subject or static (direct) Send To value references an attacker-influenced Smartcode such as an input_password field value, a cookie value, or submission.response.

CVE-2026-61964 is a high severity vulnerability in WPManageNinja's Ninja Tables plugin, affecting versions up to and including 5.2.9. It is an unauthenticated Cross-Site Scripting (XSS) flaw that arises from improper neutralization of input during web page generation. This vulnerability allows attackers to inject malicious scripts that can impact confidentiality, integrity, and availability. No official patch or remediation guidance has been provided yet.

The FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Recipient Display Name (to.name) in Email Logs in all versions up to, and including, 2.2.95 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is delivered via an attacker-controlled recipient display name (to.name) in a wp_mail() call and does not fire in the log list view — only in the detail view when an administrator uses the Prev/Next navigation controls, as that path bypasses the escapeHtml pipeline used by the list view.

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'param' in all versions up to, and including, 6.2.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

The Fluent Forms WordPress plugin up to version 6.2.8 contains an authorization bypass vulnerability via the 'transaction' parameter. This flaw allows unauthenticated attackers to brute-force transaction hashes and access sensitive payment receipt data of other users, including personal and payment details. The vulnerability arises from missing validation on a user-controlled key, enabling insecure direct object reference attacks. The brute-force attack is practical due to a limited candidate space of about 900 possibilities per second per submission and form pair.

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Name Field Nested `password` Member in all versions up to, and including, 6.2.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Fluent Support – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'redirect-to' Shortcode Attribute in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The XSS payload is in a hidden attribute so it only fires in specific browsers when specific access keys are used making exploitation unlikely.

Unauthenticated Sensitive Data Exposure in Ninja Tables <= 5.2.10 versions.

Contributor Cross Site Scripting (XSS) in Fluent Support <= 2.3.0 versions.