FluentCommunity – Ultra-Fast High-Performance Social Network, Community, LMS & Online Courses <= 2.12.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Custom SVG Icons
- ID
- WPSEC-2026-2660
- Plugin
- FluentCommunity – Ultra-Fast High-Performance Social Network, Community, LMS & Online Courses (fluent-community)
- Affected
- all versions before 2.13.0
- Remediation
- Update to 2.13.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-06
- Attack surface
- FluentCommunity – Ultra-Fast High-Performance Social Network, Community, LMS & Online Courses on WPSec AttackSurface
- Fix released
- Published
Description
The FluentCommunity plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom SVG icons (space links, space menu items, space and course settings) in all versions up to, and including, 2.12.0, due to an insufficient SVG sanitizer that keeps CDATA sections and processing instructions, which the HTML parser reads differently, and due to the sanitized SVG being rendered without escaping. This makes it possible for authenticated attackers with subscriber-level access and above who hold the space administrator role, or another community role that can edit these icons, to inject arbitrary web scripts in pages that will execute whenever a user accesses an affected page.
References
- https://wpsec.com/vuln/WPSEC-2026-2660/
- https://plugins.svn.wordpress.org/fluent-community/tags/2.13.0/
- https://wordpress.org/plugins/fluent-community/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS