CVE-2026-15665: Improper Neutralization of Input During Web Page Generation

The Fluent Support – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'redirect-to' Shortcode Attribute in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping. This makes it possible for...

WordPress Fluent Support – Helpdesk & Customer Support Ticket System plugin <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Fluent Support versions = 2.3.0...

CVE-2026-65470

Contributor Cross Site Scripting XSS in Fluent Support = 2.3.0 versions...

CVE-2026-65470 WordPress Fluent Support plugin <= 2.3.0 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Fluent Support = 2.3.0 versions...

CVE-2026-65470 WordPress Fluent Support plugin <= 2.3.0 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Fluent Support = 2.3.0 versions...

CVE-2026-65470

Contributor Cross Site Scripting XSS in Fluent Support = 2.3.0 versions...

EUVD-2026-48082

Contributor Cross Site Scripting XSS in Fluent Support = 2.3.0 versions...

CVE-2026-65470

CVE-2026-65470 describes a Cross Site Scripting (XSS) vulnerability in the WordPress Fluent Support plugin, affecting versions

CVE-2026-65470: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Fluent Support = 2.3.0 versions...

PT-2026-63892

Contributor Cross Site Scripting XSS in Fluent Support = 2.3.0 versions...

WordPress Fluent Support plugin <= 2.3.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Fluent Support versions = 2.3.0...

CVE-2026-57715

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPManageNinja Fluent CRM fluent-crm allows Reflected XSS.This issue affects Fluent CRM: from n/a through = 3.1.7...

CVE-2026-57715

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPManageNinja Fluent CRM fluent-crm allows Reflected XSS.This issue affects Fluent CRM: from n/a through = 3.1.7...

EUVD-2026-43370

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPManageNinja Fluent CRM fluent-crm allows Reflected XSS.This issue affects Fluent CRM: from n/a through = 3.1.7...

CVE-2026-57715 WordPress Fluent CRM plugin <= 3.1.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPManageNinja Fluent CRM fluent-crm allows Reflected XSS.This issue affects Fluent CRM: from n/a through = 3.1.7...

CVE-2026-57715

CVE-2026-57715 affects the WordPress Fluent CRM plugin (Fluent CRM) up to version

CVE-2026-57715 WordPress Fluent CRM plugin <= 3.1.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPManageNinja Fluent CRM fluent-crm allows Reflected XSS.This issue affects Fluent CRM: from n/a through = 3.1.7...

CVE-2026-57715: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPManageNinja Fluent CRM fluent-crm allows Reflected XSS.This issue affects Fluent CRM: from n/a through = 3.1.7...

PT-2026-57754

Name of the Vulnerable Software and Affected Versions WPManageNinja Fluent CRM versions prior to 3.1.8 Description An issue involving improper neutralization of input during web page generation allows for Reflected Cross-site Scripting XSS, a technique where malicious scripts are injected into a...

📄 WordPress Fluent Forms 6.0.4 Server-Side Template Injection / Remote Code Execution

Python exploit framework for CVE-2026-4257 targeting vulnerable WordPress sites running Fluent Forms. The tool first detects a server-side template injection by submitting the Twig expression 77 to common form fields. If the target is vulnerable, it abuses Twig's registerUndefinedFilterCallback...