{
 "id": "WPSEC-2026-2660",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2660/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2660/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2660/index.md",
 "title": "FluentCommunity – Ultra-Fast High-Performance Social Network, Community, LMS & Online Courses <= 2.12.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Custom SVG Icons",
 "description": "The FluentCommunity plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom SVG icons (space links, space menu items, space and course settings) in all versions up to, and including, 2.12.0, due to an insufficient SVG sanitizer that keeps CDATA sections and processing instructions, which the HTML parser reads differently, and due to the sanitized SVG being rendered without escaping. This makes it possible for authenticated attackers with subscriber-level access and above who hold the space administrator role, or another community role that can edit these icons, to inject arbitrary web scripts in pages that will execute whenever a user accesses an affected page.",
 "plugin": {
  "slug": "fluent-community",
  "name": "FluentCommunity – Ultra-Fast High-Performance Social Network, Community, LMS & Online Courses",
  "full_name": "FluentCommunity – Ultra-Fast High-Performance Social Network, Community, LMS & Online Courses",
  "wordpress_org": "https://wordpress.org/plugins/fluent-community/",
  "advisories_url": "https://wpsec.com/vuln/plugin/fluent-community/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/fluent-community"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.13.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.13.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.13.0",
 "remediation": "Update to 2.13.0 or later.",
 "fix_released": "2026-11-05T13:01:44+00:00",
 "published": "2026-11-06T13:52:33+00:00",
 "updated": "2026-11-06T12:04:22.740807+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2660/",
  "https://plugins.svn.wordpress.org/fluent-community/tags/2.13.0/",
  "https://wordpress.org/plugins/fluent-community/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/fluent-community",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-06"
 }
}