FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution

Information

Software Type Plugin
Software Slug fluent-crm (view on wordpress.org)
Software Status Active
Software Author wpmanageninja
Software Website fluentcrm.com
Software Downloads 1,774,297
Software Active Installs 80,000
Software Record Last Updated August 9, 2026

5 Vulnerabilities

Submit a Vulnerability
FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution <= 3.1.7 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2026-57715
Jul 9, 2026
Researcher: daroo
FluentCRM <= 2.9.87 - Unauthenticated Blind Server-Side Request Forgery via 'SubscribeURL' Parameter
5.4
CVE-2026-7798
May 21, 2026
Researcher: Saleh Elsayed (0xManticore)
FluentCRM - Marketing Automation For WordPress <= 2.9.84 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fluentcrm_content' Shortcode
6.4
CVE-2025-12935
Nov 20, 2025
Researcher: Muhammad Yudha - DJ
Fluent CRM <= 2.8.44 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2024-30430
Mar 28, 2024
Researcher: Ananda Dhakal
FluentCRM - Marketing Automation For WordPress <= 2.8.01 - Insufficient Use of Hash as Authorization Control
6.5
CVE-2023-1430
Jun 1, 2023
Researcher: Karl Emil Nikka
Title Status CVE ID CVSS Researchers Date
FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution <= 3.1.7 - Unauthenticated Stored Cross-Site Scripting Patched CVE-2026-57715 7.2 daroo July 9, 2026
FluentCRM <= 2.9.87 - Unauthenticated Blind Server-Side Request Forgery via 'SubscribeURL' Parameter Patched CVE-2026-7798 5.4 Saleh Elsayed (0xManticore) May 21, 2026
FluentCRM - Marketing Automation For WordPress <= 2.9.84 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fluentcrm_content' Shortcode Patched CVE-2025-12935 6.4 Muhammad Yudha - DJ November 20, 2025
Fluent CRM <= 2.8.44 - Authenticated (Administrator+) Stored Cross-Site Scripting Patched CVE-2024-30430 4.4 Ananda Dhakal March 28, 2024
FluentCRM - Marketing Automation For WordPress <= 2.8.01 - Insufficient Use of Hash as Authorization Control Patched CVE-2023-1430 6.5 Karl Emil Nikka June 1, 2023

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation