FluentBoards
by WordPress
CVEs (9)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2025-39551 | Cri | 0.64 | 9.8 | 0.01 | Apr 17, 2025 | Deserialization of Untrusted Data vulnerability in Mahmudul Hasan Arif FluentBoards fluent-boards allows Object Injection.This issue affects FluentBoards: from n/a through <= 1.47. | ||
| CVE-2026-40784 | Hig | 0.53 | 8.1 | 0.00 | Apr 15, 2026 | Authorization Bypass Through User-Controlled Key vulnerability in Mahmudul Hasan Arif FluentBoards fluent-boards allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentBoards: from n/a through <= 1.91.2. | ||
| CVE-2026-96821 | Med | 0.41 | 6.3 | 0.00 | Sep 30, 2026 | Subscriber Privilege Escalation in FluentBoards <= 2.0.12 versions. | ||
| CVE-2026-24561 | Med | 0.35 | 5.4 | 0.00 | Jan 23, 2026 | Missing Authorization vulnerability in Mahmudul Hasan Arif FluentBoards fluent-boards allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentBoards: from n/a through <= 1.91.1. | ||
| CVE-2026-89331 | Med | 0.34 | 5.3 | 0.00 | Sep 23, 2026 | The FluentBoards WordPress plugin before 2.1.0 does not properly restrict the member data returned by its public, token-shared board feature, allowing unauthenticated users to disclose the email addresses of a shared board's members, typically including administrators. | ||
| CVE-2026-85349 | Med | 0.28 | 4.3 | 0.00 | Sep 16, 2026 | The FluentBoards WordPress plugin before 2.0.15 does not properly verify authorization when returning the list of boards a user belongs to, allowing any authenticated user, including a Subscriber with no board access, to disclose the private board memberships of arbitrary users… | ||
| CVE-2026-14938 | Med | 0.28 | 4.3 | 0.00 | Aug 2, 2026 | The FluentBoards WordPress plugin before 1.95.3 does not verify that the items selected for a board import operation belong to a board the requesting user is authorized to access, allowing any authenticated user with member access to a single board to copy and read the stages… | ||
| CVE-2026-89328 | Low | 0.25 | 3.8 | 0.00 | Sep 16, 2026 | The FluentBoards WordPress plugin before 2.0.15 does not properly verify that a user holds board-manager privileges before performing several board-management operations, checking only board membership. This allows any member of a board to carry out manager-only actions on it,… | ||
| CVE-2026-89327 | Low | 0.25 | 3.8 | 0.00 | Sep 16, 2026 | The FluentBoards WordPress plugin before 2.0.15 does not verify that a board member submitting a comment is the user the comment is attributed to, allowing any board member to post comments that appear to be authored by another user, including administrators. |
- risk 0.64cvss 9.8epss 0.01
Deserialization of Untrusted Data vulnerability in Mahmudul Hasan Arif FluentBoards fluent-boards allows Object Injection.This issue affects FluentBoards: from n/a through <= 1.47.
- risk 0.53cvss 8.1epss 0.00
Authorization Bypass Through User-Controlled Key vulnerability in Mahmudul Hasan Arif FluentBoards fluent-boards allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentBoards: from n/a through <= 1.91.2.
- risk 0.41cvss 6.3epss 0.00
Subscriber Privilege Escalation in FluentBoards <= 2.0.12 versions.
- risk 0.35cvss 5.4epss 0.00
Missing Authorization vulnerability in Mahmudul Hasan Arif FluentBoards fluent-boards allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentBoards: from n/a through <= 1.91.1.
- risk 0.34cvss 5.3epss 0.00
The FluentBoards WordPress plugin before 2.1.0 does not properly restrict the member data returned by its public, token-shared board feature, allowing unauthenticated users to disclose the email addresses of a shared board's members, typically including administrators.
- risk 0.28cvss 4.3epss 0.00
The FluentBoards WordPress plugin before 2.0.15 does not properly verify authorization when returning the list of boards a user belongs to, allowing any authenticated user, including a Subscriber with no board access, to disclose the private board memberships of arbitrary users…
- risk 0.28cvss 4.3epss 0.00
The FluentBoards WordPress plugin before 1.95.3 does not verify that the items selected for a board import operation belong to a board the requesting user is authorized to access, allowing any authenticated user with member access to a single board to copy and read the stages…
- risk 0.25cvss 3.8epss 0.00
The FluentBoards WordPress plugin before 2.0.15 does not properly verify that a user holds board-manager privileges before performing several board-management operations, checking only board membership. This allows any member of a board to carry out manager-only actions on it,…
- risk 0.25cvss 3.8epss 0.00
The FluentBoards WordPress plugin before 2.0.15 does not verify that a board member submitting a comment is the user the comment is attributed to, allowing any board member to post comments that appear to be authored by another user, including administrators.