Skip to content
CVE PROGRAM SOURCE RECORD8.8 High

CVE-2021-34620

CSRF in WP Fluent Forms < 3.6.67 allows stored XSS and Privilege Escalation

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Wordfence

Description

The WP Fluent Forms plugin < 3.6.67 for WordPress is vulnerable to Cross-Site Request Forgery leading to stored Cross-Site Scripting and limited Privilege Escalation due to a missing nonce check in the access control function for administrative AJAX actions

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

WP Manage Ninja WP Fluent Forms

  • 3.6.67 to < 3.6.67affected

References