# CVE-2026-78273: Fluent Boards Pro cross-site scripting (XSS) in subscriber functionality

Source: https://junglewise.ai/threats/cve-2026-78273-fluent-boards-pro-cross-site-scripting-xss-in-subscriber  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-27. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-78273 · Severity: medium · CVSS 6.5 · Published 2026-08-27

Fluent Boards Pro is a WordPress plugin for creating discussion forums and community boards. A cross-site scripting vulnerability in this plugin allows attackers with subscriber-level access to inject malicious scripts that can steal visitor data or hijack user accounts. The vulnerability affects versions up to 2.0.11 and requires a user to interact with a crafted page or link, but could impact all visitors to an affected WordPress site.

Technologies: [WP ManageNinja Fluent Boards Pro](https://junglewise.ai/threats/technologies/fluent-boards-pro). Vendors: [WP ManageNinja](https://junglewise.ai/threats/vendors/wp-manageninja).

## Quick answers

**Is CVE-2026-78273 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-78273 being exploited in the wild.

**How severe is CVE-2026-78273?** Medium severity, with a CVSS score of 6.5, published 27 August 2026.

**Which products and versions are affected?** WP ManageNinja Fluent Boards Pro <= 2.0.11.

**Is there a fix for CVE-2026-78273?** A patch was published on 2026: version 2.0.12 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-78273 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-78273?** Check whether you run WP ManageNinja Fluent Boards Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a stored or reflected cross-site scripting (XSS) vulnerability in Fluent Boards Pro versions up to 2.0.11 that requires subscriber-level privileges to exploit. The vulnerability exists in subscriber functionality, allowing an authenticated subscriber to inject malicious JavaScript code. Successful exploitation requires user interaction (e.g., clicking a malicious link or visiting a crafted page), but once triggered, the injected script executes in the context of victims' browsers. An attacker can steal session cookies, perform actions on behalf of logged-in users, or redirect visitors to phishing sites. The vulnerability was patched in version 2.0.12.

## Affected products

- WP ManageNinja Fluent Boards Pro <= 2.0.11

## Timeline

- 2026-08-26: disclosed
- 2026: patched: version 2.0.12

## References

- [https://patchstack.com/database/wordpress/plugin/fluent-boards-pro/vulnerability/wordpress-fluent-boards-pro-plugin-2-0-11-cross-site-scripting-xss-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/fluent-boards-pro/vulnerability/wordpress-fluent-boards-pro-plugin-2-0-11-cross-site-scripting-xss-vulnerability?_s_id=cve)

## Related threats

- [WP ManageNinja Fluent Boards Pro arbitrary file deletion](https://junglewise.ai/threats/cve-2026-78275-wp-manageninja-fluent-boards-pro-arbitrary-file-deletion)
- [Fluent Boards Pro insecure direct object references (IDOR) in subscriber endpoints](https://junglewise.ai/threats/cve-2026-78278-fluent-boards-pro-insecure-direct-object-references-idor-in)