Executive brief
Fluent Boards Pro is a WordPress plugin for creating discussion forums and community boards. A cross-site scripting vulnerability in this plugin allows attackers with subscriber-level access to inject malicious scripts that can steal visitor data or hijack user accounts. The vulnerability affects versions up to 2.0.11 and requires a user to interact with a crafted page or link, but could impact all visitors to an affected WordPress site.
Technical details
This is a stored or reflected cross-site scripting (XSS) vulnerability in Fluent Boards Pro versions up to 2.0.11 that requires subscriber-level privileges to exploit. The vulnerability exists in subscriber functionality, allowing an authenticated subscriber to inject malicious JavaScript code. Successful exploitation requires user interaction (e.g., clicking a malicious link or visiting a crafted page), but once triggered, the injected script executes in the context of victims' browsers. An attacker can steal session cookies, perform actions on behalf of logged-in users, or redirect visitors to phishing sites. The vulnerability was patched in version 2.0.12.
Affected products
- WP ManageNinja Fluent Boards Pro <= 2.0.11
Timeline
- 2026-08-26: disclosed
- 2026: patched: version 2.0.12