Extension WordPress

Vulnérabilités Fluent Forms Pro Add On Pack

Cette page rassemble les failles publiées pour Fluent Forms Pro Add On Pack, leurs plages de versions affectées et les correctifs signalés dans la base locale.

4Vulnérabilités
0Critiques
4Avec correctif
7,5CVSS maximal

Historique de sécurité

CVE et vulnérabilités de Fluent Forms Pro Add On Pack

4 fiches

CVE-2026-2899 Moyenne · 6,5
Fluent Forms Pro Add On Pack

Fluent Forms Pro Add On Pack <= 6.1.17 – Missing Authorization to Unauthenticated Arbitrary Attachment Deletion

The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 6.1.17. This is due to the `deleteFile()` method in the `Uploader` class lacking nonce verification and…

Versions affectées

*-6.1.17

Correctif

6.1.18

Publication

04/03/2026

CVE-2026-2365 Élevée · 7,2
Fluent Forms Pro Add On Pack

Fluent Forms Pro <= 6.1.17 – Unauthenticated Stored Cross-Site Scripting via Draft Form Submission

The Fluent Forms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `fluentform_step_form_save_data` AJAX action in all versions up to, and including, 6.1.17. This is due to the draft form submission endpoint being publicly accessible…

Versions affectées

*-6.1.17

Correctif

6.1.18

Publication

04/03/2026

CVE-2026-2428 Élevée · 7,5
Fluent Forms Pro Add On Pack

Fluent Forms Pro Add On Pack <= 6.1.17 – Missing Authorization to Unauthenticated Payment Status modification

The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in all versions up to, and including, 6.1.17. This is due to the PayPal IPN (Instant Payment Notification) verification being…

Versions affectées

*-6.1.17

Correctif

6.1.18

Publication

26/02/2026

CVE-2026-0632 Moyenne · 5,4
Fluent Forms Pro Add On Pack

Fluent Forms Pro Add On Pack <= 6.1.12 – Authenticated (Subscriber+) Server-Side Request Forgery via 'saveDataSource'

The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.1.12 via the 'saveDataSource' function. This makes it possible for authenticated attackers, with Subscriber-level access…

Versions affectées

*-6.1.12

Correctif

6.1.13

Publication

08/02/2026

WP Commander

Rechercher dans toute la base WordPress

Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.

Ouvrir le tableau des vulnérabilités