CVE-2025-12935 Overview
CVE-2025-12935 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the FluentCRM plugin for WordPress. The flaw affects all versions up to and including 2.9.84. Insufficient input sanitization and output escaping on user-supplied attributes of the fluentcrm_content shortcode allow authenticated users with contributor-level access or higher to inject arbitrary web scripts. Injected scripts execute in the browser of any user who accesses the affected page.
Critical Impact
Authenticated contributors can persist malicious JavaScript into WordPress pages, enabling session theft, administrative account takeover, and site defacement when higher-privileged users view the injected content.
Affected Products
- FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution plugin for WordPress
- All versions up to and including 2.9.84
- WordPress sites permitting contributor-level or higher registration
Discovery Timeline
- 2025-11-21 - CVE-2025-12935 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-12935
Vulnerability Analysis
The vulnerability resides in FluentCRM's shortcode processing logic. The plugin registers the fluentcrm_content shortcode and accepts attributes supplied by the content author. These attributes flow into rendered page output without adequate sanitization or context-aware escaping. An attacker with contributor privileges can craft a post or page containing the shortcode with malicious attribute values that break out of the intended HTML context.
When an administrator, editor, or site visitor opens the affected page, the browser parses and executes the injected script under the site's origin. This grants the attacker access to the victim's session cookies, CSRF tokens, and any DOM-accessible data. Common post-exploitation actions include creating rogue administrator accounts, injecting SEO spam, or pivoting to install malicious plugins.
The relevant plugin source can be reviewed in the FluentCRM PrefFormHandler and the FluentCRM actions handler.
Root Cause
The plugin fails to apply WordPress sanitization functions such as esc_attr() or wp_kses() to shortcode attribute values before rendering them into the HTML response. Contributor role users can author draft content that includes the vulnerable shortcode, storing the payload in the WordPress database.
Attack Vector
An authenticated contributor submits a draft page or post containing the fluentcrm_content shortcode with attribute values holding JavaScript payloads. Once the content is published or previewed by a higher-privileged user, the payload executes in that user's authenticated browser session. The scope change reflected in the vulnerability metadata indicates the impact extends beyond the vulnerable component into the wider WordPress site context.
See the Wordfence advisory for additional exploitation context.
Detection Methods for CVE-2025-12935
Indicators of Compromise
- Unexpected <script>, onerror, or onload fragments embedded within fluentcrm_content shortcode attributes in wp_posts table entries.
- Newly created administrator accounts or modified user roles following contributor activity.
- Outbound requests from admin sessions to unknown domains shortly after visiting FluentCRM-managed pages.
Detection Strategies
- Query the WordPress database for post_content entries containing [fluentcrm_content alongside suspicious characters such as <, ", or javascript:.
- Monitor WordPress audit logs for contributor accounts publishing or previewing pages referencing FluentCRM shortcodes.
- Inspect web server access logs for POST requests to /wp-admin/post.php containing shortcode payloads followed by admin visits to /?p= URLs.
Monitoring Recommendations
- Enable a WordPress activity logging plugin to capture role changes, plugin installs, and content edits performed by contributors.
- Deploy a Content Security Policy (CSP) that reports script violations to a monitoring endpoint.
- Alert on FluentCRM plugin version strings below 2.9.85 reported by asset inventory scans.
How to Mitigate CVE-2025-12935
Immediate Actions Required
- Update the FluentCRM plugin to the version released after 2.9.84 that addresses the shortcode sanitization gap.
- Audit all existing pages and posts for the fluentcrm_content shortcode and remove any unexpected attribute payloads.
- Review contributor and author accounts, disabling any that are unused or unrecognized.
Patch Information
The vendor addressed the issue in the FluentCRM release referenced by changeset 3399640. Site administrators should install this update through the WordPress plugin manager and confirm the reported version is above 2.9.84.
Workarounds
- Restrict content creation privileges by removing the contributor role from untrusted users until patching is complete.
- Temporarily deactivate the FluentCRM plugin on sites where the update cannot be applied immediately.
- Enforce a strict Content Security Policy that disallows inline script execution to reduce XSS payload impact.
# Verify installed FluentCRM version via WP-CLI
wp plugin get fluent-crm --field=version
# Update FluentCRM to the latest patched release
wp plugin update fluent-crm
# Identify posts containing the vulnerable shortcode
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%[fluentcrm_content%';"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
