CVE-2026-66467
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
Cross Site Scripting (XSS) vulnerability in FluentCommunity versions up to 2.7.5, exploitable by a user with Subscriber role.
Risk Assessment
An attacker can inject malicious script, potentially leading to session theft or admin account takeover.
Recommendation
Update the FluentCommunity plugin to the latest patched version.
Other vulnerabilities in FluentCommunity
See all- CVE-2026-111836Medium
The FluentCommunity plugin up to version 2.11.0 has a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. An unauthorized user may perform actions requiring higher privileges.
- CVE-2025-66084Medium
Missing Authorization vulnerability in Shahjahan Jewel FluentCommunity fluent-community allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentCommunity: from n/a through <= 2.0.0.
Original NVD description (English source)
Subscriber Cross Site Scripting (XSS) in FluentCommunity <= 2.7.5 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS