CVE Database /
CVE-2025-12935
CVE · Medium
CVE-2025-12935 — FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution [fluent-crm] < 2.9.85
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2025-12935
|
FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution [fluent-crm] < 2.9.85 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Medium
6.4
|
< 2.9.85
|
2.9.85 |
2025-11-20 |
—
|
CVE-2025-12935
The FluentCRM plugin for WordPress contains a security flaw affecting all versions up to 2.9.84, where unsanitized input from users can be injected into the 'fluentcrm_content' shortcode, allowing attackers with contributor-level access or higher to embed malicious scripts that will run when accessed by other users. This vulnerability enables attackers to execute arbitrary web code on affected pages.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings