techjewel Vulnerabilities and Affected Products
Vulnerabilities associated with FluentAuth – The Ultimate Authorization & Security Plugin for WordPress.
Products
Clear product- Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder25 vulnerabilities
- Fluent Forms Pro Add On Pack5 vulnerabilities
- Ninja Tables – Easy Data Table Builder4 vulnerabilities
- FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution3 vulnerabilities
- Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution2 vulnerabilities
- FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider2 vulnerabilities
- Fluent Support – Helpdesk & Customer Support Ticket System1 vulnerability
- FluentAuth – The Ultimate Authorization & Security Plugin for WordPress1 vulnerability
- WP GDPR Cookie Consent1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2025-13728MEDIUM | FluentAuth - Auth Security Plugin <= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fluent_auth_reset_password' ShortcodeThe FluentAuth – The Ultimate Authorization & Security Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `fluent_auth_reset_password` shortcode in all versions up to, and including, 2.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user ac… CWE-79Dec 15, 2025 | CVSS6.4v3.1 | EPSS0.176% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |