CVE-2026-57715
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The Fluent CRM WordPress plugin contains a reflected XSS (Cross-site Scripting) vulnerability due to improper input neutralization during page generation. The issue affects versions up to and including 3.1.7.
Risk Assessment
An attacker can inject malicious JavaScript code into the page, potentially leading to session hijacking, redirection to malicious sites, or theft of sensitive data.
Recommendation
Immediately update the Fluent CRM plugin to version 3.1.8 or later, which includes a fix for this vulnerability.
Other vulnerabilities in Fluent CRM
See all- CVE-2026-109694Critical
The Fluent CRM plugin (up to 3.2.5) contains an incorrect privilege assignment vulnerability that allows privilege escalation. An attacker could exploit this flaw to gain higher privileges within the WordPress system.
- CVE-2026-62056Medium
The Fluent CRM plugin (WP ManageNinja LLC) through 3.2.6 contains a missing authorization vulnerability. This allows exploitation of incorrectly configured access control security levels.
- CVE-2026-62141Medium
The Fluent CRM WordPress plugin through version 3.2.6 contains a missing authorization vulnerability due to incorrectly configured access control security levels. This may allow exploitation of misconfigured access controls.
- CVE-2026-109693High
Incorrect Privilege Assignment vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Privilege Escalation. This issue affects Fluent CRM: from n/a through 3.2.5.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPManageNinja Fluent CRM fluent-crm allows Reflected XSS.This issue affects Fluent CRM: from n/a through <= 3.1.7.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS