# cve.now: Wpmanageninja

The newest entries naming Wpmanageninja as an affected vendor (up to 200), of 35 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-119213](https://cve.now/CVE-2026-119213.md): Fluent Support \<= 2.4.7 — Unauthenticated Limited Modification of Linked Customer Profile Fields via Fluent Forms Feed (CVSS 3.7)
- [CVE-2026-120577](https://cve.now/CVE-2026-120577.md): FluentCart A New Era of eCommerce \<= 1.6.2 - Authenticated (Custom+) Arbitrary File Deletion via 'file\_path' Parameter (CVSS 8.1)
- [CVE-2026-103525](https://cve.now/CVE-2026-103525.md): FluentCart A New Era of eCommerce \<= 1.7.0 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'order\_id' and 'billing\_address\_id' Parameters (CVSS 7.5)
- [CVE-2026-103518](https://cve.now/CVE-2026-103518.md): FluentCart A New Era of eCommerce \<= 1.7.0 - Authenticated (Administrator+) SQL Injection via 'products.variants' Array Keys (CVSS 4.9)
- [CVE-2026-109695](https://cve.now/CVE-2026-109695.md): WordPress FluentCart plugin \<= 1.7.1 - Sensitive Data Exposure vulnerability (CVSS 7.5)
- [CVE-2026-108484](https://cve.now/CVE-2026-108484.md): WordPress Best Payments Plugin for WP plugin \<= 4.6.27 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-15178](https://cve.now/CVE-2026-15178.md): Fluent Forms \<= 6.2.5 - Missing Authorization to Authenticated (Custom+) Sensitive Data Exposure and Modification (CVSS 5.4)
- [CVE-2026-101324](https://cve.now/CVE-2026-101324.md): Fluent Forms \<= 6.2.14 - Reflected Cross-Site Scripting via '{get.\*}' Editor SmartCode Parameter (CVSS 4.7)
- [CVE-2026-94679](https://cve.now/CVE-2026-94679.md): WordPress Fluent Support plugin \<= 2.3.2 - Broken Access Control vulnerability (CVSS 5.4)
- [CVE-2026-66633](https://cve.now/CVE-2026-66633.md): WordPress Fluent Forms Pro Add On Pack plugin \< 6.2.12 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-73532](https://cve.now/CVE-2026-73532.md): Fluent Forms Pro 6.2.7 Embedded Malicious Code via Tampered Plugin Build (CVSS 9.3)
- [CVE-2026-73533](https://cve.now/CVE-2026-73533.md): Ninja Tables Pro 5.2.11 Embedded Malicious Code via Tampered Plugin Build (CVSS 9.3)
- [CVE-2026-66467](https://cve.now/CVE-2026-66467.md): WordPress FluentCommunity plugin \<= 2.7.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-18146](https://cve.now/CVE-2026-18146.md): Fluent Forms \<= 6.2.11 - Unauthenticated Stored Cross-Site Scripting via Notification Smartcode Values (CVSS 7.2)
- [CVE-2026-61964](https://cve.now/CVE-2026-61964.md): WordPress Ninja Tables plugin \<= 5.2.9 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-16636](https://cve.now/CVE-2026-16636.md): FluentSMTP \<= 2.2.95 - Unauthenticated Stored Cross-Site Scripting via Recipient Display Name (to.name) in Email Logs (CVSS 7.2)
- [CVE-2026-17571](https://cve.now/CVE-2026-17571.md): Fluent Forms \<= 6.2.8 - Reflected Cross-Site Scripting via 'param' (CVSS 6.1)
- [CVE-2026-17567](https://cve.now/CVE-2026-17567.md): Fluent Forms \<= 6.2.8 - Unauthenticated Sensitive Information Exposure via Insecure Direct Object Reference and Weak Transaction Hash in 'transaction' Parameter (CVSS 5.3)
- [CVE-2026-16655](https://cve.now/CVE-2026-16655.md): Fluent Forms \<= 6.2.7 - Unauthenticated Stored Cross-Site Scripting via Name Field Nested \`password\` Member (CVSS 7.2)
- [CVE-2026-15665](https://cve.now/CVE-2026-15665.md): Fluent Support \<= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'redirect-to' Shortcode Attribute (CVSS 6.4)
- [CVE-2026-65474](https://cve.now/CVE-2026-65474.md): WordPress Ninja Tables plugin \<= 5.2.10 - Sensitive Data Exposure vulnerability (CVSS 5.3)
- [CVE-2026-65470](https://cve.now/CVE-2026-65470.md): WordPress Fluent Support plugin \<= 2.3.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-57715](https://cve.now/CVE-2026-57715.md): WordPress Fluent CRM plugin \<= 3.1.7 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-5069](https://cve.now/CVE-2026-5069.md): Fluent Forms \<= 6.2.1 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Subscription Cancellation via 'subscription\_id' (CVSS 5.4)
- [CVE-2026-57638](https://cve.now/CVE-2026-57638.md): WordPress Fluent Booking plugin \<= 2.1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-42655](https://cve.now/CVE-2026-42655.md): WordPress Best Payments Plugin for WP plugin \<= 4.6.19 - Payment Bypass vulnerability (CVSS 7.5)
- [CVE-2025-67971](https://cve.now/CVE-2025-67971.md): WordPress FluentCart plugin \< 1.3.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-13495](https://cve.now/CVE-2025-13495.md): FluentCart A New Era of eCommerce \<= 1.3.1 - Authenticated (Administrator+) SQL Injection via 'groupKey' Parameter (CVSS 4.9)
- [CVE-2024-23504](https://cve.now/CVE-2024-23504.md): WordPress Ninja Tables plugin \<= 5.0.5 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2024-23503](https://cve.now/CVE-2024-23503.md): WordPress Ninja Tables plugin \<= 5.0.6 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2024-35635](https://cve.now/CVE-2024-35635.md): WordPress Ninja Tables plugin \<= 5.0.9 - Server Side Request Forgery (SSRF) vulnerability (CVSS 4.4)
- [CVE-2023-6953](https://cve.now/CVE-2023-6953.md): PDF Generator For Fluent Forms \<= 1.1.7 - Cross-Site Scripting (CVSS 4.9)
- [CVE-2023-51547](https://cve.now/CVE-2023-51547.md): WordPress Fluent Support Plugin \<= 1.7.6 is vulnerable to SQL Injection (CVSS 7.6)
- [CVE-2022-47136](https://cve.now/CVE-2022-47136.md): WordPress Ninja Tables Plugin \<= 4.3.4 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3)
- [CVE-2022-47137](https://cve.now/CVE-2022-47137.md): WordPress Ninja Tables Plugin \<= 4.3.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/wpmanageninja
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.