FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution <= 3.2.0 - Unauthenticated Stored Cross-Site Scripting via Contact Field Smartcodes in Fluent Forms
- ID
- WPSEC-2026-0104
- Plugin
- FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution (fluent-crm)
- Affected
- from 2.5.95 before 3.2.5
- Remediation
- Update to 3.2.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution on WPSec AttackSurface
- Fix released
- Published
Description
The FluentCRM plugin for WordPress is vulnerable to Stored Cross-Site Scripting via contact field values used in Fluent Forms smartcodes ({fluentcrm.*}) in versions 2.5.95 up to, and including, 3.2.0 due to insufficient output escaping. FluentCRM returned the current contact's field values raw to Fluent Forms, which substitutes them into the finished form HTML without escaping. Because a public Fluent Forms submission with a FluentCRM feed creates or updates the contact matching the submitted email (including first/last name and mapped fields) by default, unauthenticated attackers can store a value that breaks out of an HTML attribute (double quotes survive sanitize_text_field) or supplies a javascript: URL. The script executes when the targeted contact (a logged-in user whose email matches, such as an administrator, or a visitor identified by the fc_hash_secure cookie) views a form that uses FluentCRM contact smartcodes.
References
- https://wpsec.com/vuln/WPSEC-2026-0104/
- https://plugins.svn.wordpress.org/fluent-crm/tags/3.2.5/
- https://wordpress.org/plugins/fluent-crm/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS