# cve.now: Techjewel

The newest entries naming Techjewel as an affected vendor (up to 200), of 44 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-15962](https://cve.now/CVE-2026-15962.md): Fluent Forms Pro Add On Pack \<= 6.2.6 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary User Password Change via User Meta Field (CVSS 8.8)
- [CVE-2026-8977](https://cve.now/CVE-2026-8977.md): WP GDPR Cookie Consent \<= 1.0.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'ninja\_gdpr\_ajax\_actions' AJAX Action (CVSS 6.4)
- [CVE-2026-7798](https://cve.now/CVE-2026-7798.md): FluentCRM \<= 2.9.87 - Unauthenticated Blind Server-Side Request Forgery via 'SubscribeURL' Parameter (CVSS 5.4)
- [CVE-2026-5395](https://cve.now/CVE-2026-5395.md): Fluent Forms \<= 6.2.0 - Authenticated (Subscriber+) Authorization Bypass via 'table' Parameter (CVSS 8.2)
- [CVE-2026-5396](https://cve.now/CVE-2026-5396.md): Fluent Forms \<= 6.1.21 - Authenticated (Subscriber+) Authorization Bypass via 'form\_id' Parameter (CVSS 8.2)
- [CVE-2026-6828](https://cve.now/CVE-2026-6828.md): Fluent Forms \<= 6.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'permission\_message' Shortcode Attribute (CVSS 6.4)
- [CVE-2026-6344](https://cve.now/CVE-2026-6344.md): Fluent Forms \<= 6.2.1 - Authenticated (Administrator+) Arbitrary File Read via Path Traversal in Email Attachment (CVSS 4.9)
- [CVE-2026-2306](https://cve.now/CVE-2026-2306.md): Ninja Tables \<= 5.2.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Table Creation (CVSS 4.3)
- [CVE-2026-4160](https://cve.now/CVE-2026-4160.md): Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder \<= 6.1.21 - Insecure Direct Object Reference in Stripe SCA Confirmation to Unauthenticated Payment Status Modification (CVSS 5.3)
- [CVE-2026-2231](https://cve.now/CVE-2026-2231.md): Fluent Booking \<= 2.0.01 - Unauthenticated Stored Cross-Site Scripting via Multiple Parameters (CVSS 7.2)
- [CVE-2026-2899](https://cve.now/CVE-2026-2899.md): Fluent Forms Pro Add On Pack \<= 6.1.17 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion (CVSS 6.5)
- [CVE-2026-2365](https://cve.now/CVE-2026-2365.md): Fluent Forms Pro \<= 6.1.17 - Unauthenticated Stored Cross-Site Scripting via Draft Form Submission (CVSS 7.2)
- [CVE-2026-2428](https://cve.now/CVE-2026-2428.md): Fluent Forms Pro Add On Pack \<= 6.1.17 - Missing Authorization to Unauthenticated Payment Status modification (CVSS 7.5)
- [CVE-2026-0996](https://cve.now/CVE-2026-0996.md): Fluent Forms \<= 6.1.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via AI Form Builder Module (CVSS 6.4)
- [CVE-2026-0632](https://cve.now/CVE-2026-0632.md): Fluent Forms Pro Add On Pack \<= 6.1.12 - Authenticated (Subscriber+) Server-Side Request Forgery via 'saveDataSource' (CVSS 5.4)
- [CVE-2025-13722](https://cve.now/CVE-2025-13722.md): Fluent Forms \<= 6.1.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Form Creation via AI Builder (CVSS 5.3)
- [CVE-2025-13728](https://cve.now/CVE-2025-13728.md): FluentAuth - Auth Security Plugin \<= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fluent\_auth\_reset\_password' Shortcode (CVSS 6.4)
- [CVE-2025-13748](https://cve.now/CVE-2025-13748.md): Fluent Forms \<= 6.1.7 - Unauthenticated Insecure Direct Object Reference to Payment Status Tampering via submission\_id (CVSS 5.3)
- [CVE-2025-13756](https://cve.now/CVE-2025-13756.md): Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution \<= 1.9.11 - Authenticated (Subscriber+) Missing Authorization to Calendar Import and Management (CVSS 4.3)
- [CVE-2025-12935](https://cve.now/CVE-2025-12935.md): FluentCRM - Marketing Automation For WordPress \<= 2.9.84 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fluentcrm\_content' Shortcode (CVSS 6.4)
- [CVE-2025-9260](https://cve.now/CVE-2025-9260.md): Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder 5.1.16 - 6.1.1 - Authenticated (Subscriber+) PHP Object Injection To Arbitrary File Read (CVSS 6.5)
- [CVE-2025-2940](https://cve.now/CVE-2025-2940.md): Ninja Tables – Easy Data Table Builder \<= 5.0.18 - Unauthenticated Server-Side Request Forgery (CVSS 7.2)
- [CVE-2025-2939](https://cve.now/CVE-2025-2939.md): Ninja Tables – Easy Data Table Builder \<= 5.0.18 - Unauthenticated PHP Object Injection to Limited Remote Code Execution (CVSS 5.6)
- [CVE-2025-3615](https://cve.now/CVE-2025-3615.md): Fluent Forms \<= 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-13666](https://cve.now/CVE-2024-13666.md): Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder \<= 5.2.12 - IP-Spoofing (CVSS 5.3)
- [CVE-2024-13568](https://cve.now/CVE-2024-13568.md): Fluent Support – Helpdesk & Customer Support Ticket System \<= 1.8.5 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory (CVSS 7.5)
- [CVE-2024-10646](https://cve.now/CVE-2024-10646.md): Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder \<= 5.2.6 - Unauthenticated Stored Cross-Site Scripting via Form Subject (CVSS 7.2)
- [CVE-2024-9511](https://cve.now/CVE-2024-9511.md): FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider \<= 2.2.82 - Unauthenticated PHP Object Injection (CVSS 9.8)
- [CVE-2024-9528](https://cve.now/CVE-2024-9528.md): Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder \<= 5.1.19 - Authenticated (Form Manager+) Stored Cross-Site Scripting (CVSS 4.9)
- [CVE-2024-5053](https://cve.now/CVE-2024-5053.md): Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder \<= 5.1.18 - Missing Authorization to Authenticated (Subscriber+) Mailchimp Integration Modification (CVSS 4.2)
- [CVE-2024-7304](https://cve.now/CVE-2024-7304.md): Ninja Tables – Easiest Data Table Builder \<= 5.0.12 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4)
- [CVE-2024-6703](https://cve.now/CVE-2024-6703.md): Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder \<= 5.1.19 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Welcome Screen Fields (CVSS 4.9)
- [CVE-2024-6518](https://cve.now/CVE-2024-6518.md): Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder \<= 5.1.19 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 4.4)
- [CVE-2024-6520](https://cve.now/CVE-2024-6520.md): Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder \<= 5.1.19 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 4.4)
- [CVE-2024-6521](https://cve.now/CVE-2024-6521.md): Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder \<= 5.1.19 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 4.4)
- [CVE-2024-4157](https://cve.now/CVE-2024-4157.md): Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder \<= 5.1.15 - PHP Object Injection via extractDynamicValues (CVSS 7.5)
- [CVE-2024-4709](https://cve.now/CVE-2024-4709.md): Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder \<= 5.1.16 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-2772](https://cve.now/CVE-2024-2772.md): Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder \<= 5.1.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-2782](https://cve.now/CVE-2024-2782.md): Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder \<= 5.1.16 - Missing Authorization to Setting Manipulation (CVSS 7.5)
- [CVE-2024-2771](https://cve.now/CVE-2024-2771.md): Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder \<= 5.1.16 - Missing Authorization to Settings Update and Limited Privilege Escalation (CVSS 9.8)
- [CVE-2023-6957](https://cve.now/CVE-2023-6957.md): Fluent Forms \<= 5.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 4.9)
- [CVE-2024-0618](https://cve.now/CVE-2024-0618.md): Fluent Forms \<= 5.1.5 - Authenticated(Administrator+) Stored Cross-Site Scripting via imported form title (CVSS 4.4)
- [CVE-2023-3087](https://cve.now/CVE-2023-3087.md): FluentSMTP \<= 2.2.4 - Unauthenticated Stored Cross-Site Scripting via Email Subject (CVSS 7.2)
- [CVE-2023-1430](https://cve.now/CVE-2023-1430.md): FluentCRM - Marketing Automation For WordPress \<= 2.8.01 - Insufficient Use of Hash as Authorization Control (CVSS 6.5)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/techjewel
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.