# FluentCommunity – Ultra-Fast High-Performance Social Network, Community, LMS & Online Courses <= 2.12.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Custom SVG Icons

- **ID:** WPSEC-2026-2660
- **Plugin:** FluentCommunity – Ultra-Fast High-Performance Social Network, Community, LMS & Online Courses (`fluent-community`), https://wordpress.org/plugins/fluent-community/
- **Affected versions:** all versions before 2.13.0
- **Fixed in:** 2.13.0 (Update to 2.13.0 or later.)
- **Severity:** Medium 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-06)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/fluent-community
- **Fix released:** 2026-11-05
- **Published:** 2026-11-06
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2660/

## Description

The FluentCommunity plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom SVG icons (space links, space menu items, space and course settings) in all versions up to, and including, 2.12.0, due to an insufficient SVG sanitizer that keeps CDATA sections and processing instructions, which the HTML parser reads differently, and due to the sanitized SVG being rendered without escaping. This makes it possible for authenticated attackers with subscriber-level access and above who hold the space administrator role, or another community role that can edit these icons, to inject arbitrary web scripts in pages that will execute whenever a user accesses an affected page.

## References

- https://wpsec.com/vuln/WPSEC-2026-2660/
- https://plugins.svn.wordpress.org/fluent-community/tags/2.13.0/
- https://wordpress.org/plugins/fluent-community/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2660/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.