CVE-2025-13728

MediumCVSS 6.4

Published: 15/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

7th percentile - higher than 7% of all known CVEs

Summary

The FluentAuth – The Ultimate Authorization & Security Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `fluent_auth_reset_password` shortcode in all versions up to and including 2.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This allows authenticated attackers with contributor level access and above to inject arbitrary web scripts in pages that execute whenever a user accesses an injected page.

Risk Assessment

An attacker with low privileges can inject malicious scripts that may steal user data, hijack sessions, or modify page content, posing a serious threat to integrity and confidentiality.

Recommendation

Update the plugin to the latest version if available, and restrict access to shortcodes to trusted users only. Apply proper sanitization and escaping.

Other vulnerabilities in FluentAuth

CVE-2026-78296Medium
The FluentAuth WordPress plugin in versions up to and including 2.1.2 has insufficient verification of data authenticity, allowing identity spoofing. An attacker could exploit this to impersonate another identity within the system.

Original NVD description (English source)

The FluentAuth – The Ultimate Authorization & Security Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `fluent_auth_reset_password` shortcode in all versions up to, and including, 2.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS