CVE-2021-34620 CSRF in WP Fluent Forms < 3.6.67 allows stored XSS and Privilege Escalation

2021-07-0712:21:04

CWE-79

CWE-352

Wordfence

www.cve.org

wp fluent forms

csrf

xss

privilege escalation

wordpress

ajax

AI Score

8.4

Confidence

High

EPSS

0.002

Percentile

53.4%

JSON

The WP Fluent Forms plugin < 3.6.67 for WordPress is vulnerable to Cross-Site Request Forgery leading to stored Cross-Site Scripting and limited Privilege Escalation due to a missing nonce check in the access control function for administrative AJAX actions

CNA Affected

[
  {
    "product": "WP Fluent Forms",
    "vendor": "WP Manage Ninja",
    "versions": [
      {
        "lessThan": "3.6.67",
        "status": "affected",
        "version": "3.6.67",
        "versionType": "custom"
      }
    ]
  }
]