Fluent Forms Pro Add On Pack vulnerabilities

Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack versions up to 6.2.12.

Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack versions up to 6.2.12.

Unauthenticated XSS vulnerability in Fluent Forms Pro Add On Pack versions prior to 6.2.12. An attacker can inject malicious scripts that execute in the victim's browser.

The Fluent Forms Pro Add On Pack plugin for WordPress up to version 6.2.6 is vulnerable to PHP Object Injection via deserialization of untrusted input. Authenticated attackers with Subscriber-level access or above can inject a PHP Object. The presence of a POP chain allows changing user passwords and potentially taking over administrator accounts. Exploitation is only possible if user update integration is enabled and a user meta field is mapped.