Description

Subscriber Cross Site Scripting (XSS) in Fluent Boards Pro <= 2.0.11 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-27T10:16:37.260Z",
  "pubdate": "2026-08-27T10:16:37.260Z",
  "executiveSummary": "Fluent Boards Pro versions 2.0.11 and below contain a Stored Cross-Site Scripting (XSS) vulnerability. This security flaw originates from improper neutralization of user-supplied input before rendering it in the browser interface. The vulnerability allows authenticated users with low-level privileges, such as Subscribers, to inject malicious JavaScript into the application, which is then executed in the context of an administrator's or another user's session.\nThe primary risk associated with this vulnerability is the potential for full account takeover, unauthorized actions performed on behalf of legitimate users, and the exfiltration of sensitive session data or administrative cookies. Because the malicious script executes whenever a victim views the affected component, the impact is significant. Exploitation does not require advanced technical skill, but it does necessitate that the attacker possesses at least a Subscriber-level account on the WordPress installation. This vulnerability represents a failure in input validation and output encoding mechanisms within the plugin's data handling routines.",
  "technicalDetails": "The vulnerability is classified as Stored Cross-Site Scripting (XSS) occurring due to the inadequate sanitization of user-provided data within Fluent Boards Pro, affecting versions 2.0.11 and below. The root cause is the failure of the application to properly sanitize or encode user input before it is persisted in the database and subsequently rendered in the administrative or user dashboard interface.\nThe attack flow commences when a malicious actor, authenticated as a user with Subscriber privileges, interacts with specific input fields or components provided by the Fluent Boards Pro plugin. By injecting crafted HTML and JavaScript payloads into these fields, the attacker submits data that is stored directly into the WordPress database without sufficient security filtering. When an administrator or another authorized user navigates to the specific board or interface section where this data is rendered, the browser interprets the stored payload as executable code rather than plain text.\nBecause the payload executes within the security context of the victim's session, the malicious script inherits the victim's privileges. This allows for several post-exploitation activities, including: 1) Theft of session tokens or authentication cookies via document.cookie, which can lead to session hijacking. 2) The execution of unauthorized administrative functions, such as creating new administrative users or modifying sensitive plugin settings, leveraging the victim's session to bypass CSRF protections. 3) Redirection of the user to external, malicious domains or the modification of the visual appearance of the web page to facilitate phishing (defacement).\nThe vulnerability exists because the plugin fails to implement robust context-aware output encoding (such as escaping data before outputting it into the HTML DOM) or server-side input sanitization (using functions like sanitize_text_field, wp_kses_post, or similar WordPress core security functions). Since the application processes this data dynamically, any user with the ability to input content into the affected component serves as a vector for the XSS attack. The exposure is limited to authenticated users, but the high level of trust typically placed in administrative actions makes the impact of this XSS particularly dangerous for the integrity and confidentiality of the WordPress installation."
}