CVE-2025-12935

CVSS 6.4 Medium
  • CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
  • Published: 2025-11-21T13:15:45.850

The FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘fluentcrm_content’ shortcode in all versions up to, and including, 2.9.84 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Related CVE by CWE

No related CWE found.

Top CVE for Vendor

No vendor taxonomy on this entry.

Recently Exploited Similar Vulnerabilities

No recent KEV-listed items for this vendor/product.

How to fix CVE-2025-12935

CVE-2025-12935 is a medium severity vulnerability affecting the affected product.

Description: The FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘fluentcrm_content’ shortcode in all versions up to, and including, 2.9.84 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated […]

Affected Versions:
❌ Vulnerable: ≤ 2.9.84
✅ Safe: ≥ 2.9.85

Exploit Difficulty: EASY
⏱️ Time to exploit: < 1 hour
🛠️ Required skills: Basic web security knowledge
💰 Public exploits: Likely available

How to Fix:

1 Identify affected systems

- Check if you're running the affected product
- Verify version (vulnerable: ≤ 2.9.84)

2 Immediate actions

- Update to ≥ 2.9.85 or later
- If patching is not immediately possible: restrict network exposure, apply least-privilege access

3 Verification

- Test the fix in a staging environment first
- Review logs for signs of exploitation
- Monitor for IOCs (Indicators of Compromise)

4 Long-term prevention

- Enable automatic security updates
- Set up vulnerability monitoring
- Review and harden security configurations

Exploit Difficulty Assessment

EASY
⏱️ Time to Exploit: < 1 hour
🛠️ Skills Required: Basic web security knowledge
💰 Public Exploits: Likely available

Affected Versions

❌ Vulnerable: ≤ 2.9.84
✅ Safe: ≥ 2.9.85

Vulnerability Timeline

Nov 21, 2025
Vulnerability Published

CVE details first published to NVD database

Nov 21, 2025
Imported to Database

Added to this CVE tracking system

Detection Rules & IOCs

No specific detection rules generated for this vulnerability type.

No vendor/product data available.