WordPress Plugin Vulnerabilities

WP Fluent Forms < 3.6.67 - Cross-Site Request Forgery (CSRF)

Description

The WP Fluent Forms WordPress plugin was vulnerable to a Cross-Site Request Forgery (CSRF) vulnerability that could lead to Stored Cross-Site Scripting (XSS).

Affects Plugins

Plugin icon
fluentform
Fixed in 3.6.67

References

CVE
CVE-2021-34620
URL
https://www.wordfence.com/blog/2021/06/cross-site-request-forgery-patched-in-wp-fluent-forms/

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
7.1 (high)

Miscellaneous

Original Researcher
Ramuel Gall of Wordfence
Verified
No
WPVDB ID
16070387-e2b2-4b97-8cd8-cc2db80a3995

Timeline

Publicly Published
2021-06-17 (about 4 years ago)
Added
2021-06-17 (about 4 years ago)
Last Updated
2021-06-25 (about 4 years ago)

Other

Published
Title
Published
2024-11-28
Title
WP Revisions Manager <= 1.0.2 - Cross-Site Request Forgery
Published
2025-11-03
Title
ViaAds < 2.1.3 - Cross-Site Request Forgery to API Key Update
Published
2025-09-05
Title
AP HoneyPot WordPress Plugin <= 1.4 - Cross-Site Request Forgery
Published
2025-01-16
Title
Len Slider <= 2.0.11 - Cross-Site Request Forgery to Reflected Cross-Site Scripting
Published
2023-03-30
Title
Premmerce Redirect Manager < 1.0.11 - Cross-Site Request Forgery