Stored Cross-Site Scripting Vulnerability in FluentCRM Plugin for WordPress
CVE-2025-12935
6.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 21 November 2025
What is CVE-2025-12935?
The FluentCRM plugin for WordPress is susceptible to stored cross-site scripting (XSS) due to inadequate input sanitization and output escaping on user-supplied attributes within the 'fluentcrm_content' shortcode. This vulnerability affects all versions up to and including 2.9.84, enabling authenticated attackers with contributor-level access or higher to inject malicious web scripts. The injected scripts execute whenever users access compromised pages, posing a significant security risk for WordPress site administrators and their visitors.
Affected Version(s)
FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution * <= 2.9.84