Wpmanageninja
Vulnerability activity for Wpmanageninja: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 7
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 8
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 9
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 8.1HighNov 3, 2026Wpmanageninja FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler Path traversal / file handlingCVE-2026-120577The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteFile function in all versions up to, and including, 1.6.2. This makes it possible for authenticated attackers, with custom-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
- 7.5HighOct 16, 2026Wpmanageninja FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler Auth bypass / access controlCVE-2026-103525The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.7.0 via the 'order_id + billing_address_id (also shipping_address_id)' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to read and exfiltrate another customer's stored billing and shipping address PII — including street address, city, state, postcode, p
- 4.9MediumOct 16, 2026Wpmanageninja FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler SQL injectionCVE-2026-103518The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to generic SQL Injection via the 'products[*].variants[*].<attacker-chosen key>' parameter in all versions up to, and including, 1.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already exist
- 7.5HighOct 15, 2026WPManageNinja FluentCart Information disclosureCVE-2026-109695Insertion of Sensitive Information Into Sent Data vulnerability in WPManageNinja FluentCart fluent-cart allows Retrieve Embedded Sensitive Data.This issue affects FluentCart: from n/a through 1.7.1.
- 7.1HighOct 14, 2026WPManageNinja Best Payments Plugin for WP XSSCVE-2026-108484Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPManageNinja Best Payments Plugin for WP wp-payment-form allows Stored XSS.This issue affects Best Payments Plugin for WP: from n/a through 4.6.27.
- 5.4MediumOct 10, 2026Wpmanageninja Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder Auth bypass / access controlCVE-2026-15178The Fluent Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.2.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Custom-level access and above, to read private form submissions, change submission statuses, permanently delete submissions, and modify global plugin settings.
- 4.7MediumOct 10, 2026Wpmanageninja Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder XSSCVE-2026-101324The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'any attacker-chosen name matching the {get.NAME} placeholder (PoC uses 'proof')' parameter in all versions up to, and including, 6.2.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully tri
- 5.4MediumSep 23, 2026WPManageNinja Fluent Support Auth bypass / access controlCVE-2026-94679Subscriber Broken Access Control in Fluent Support <= 2.3.2 versions.
- 6.5MediumJun 26, 2026WPManageNinja Fluent Booking XSSCVE-2026-57638Contributor Cross Site Scripting (XSS) in Fluent Booking <= 2.1.0 versions.
Top products
- FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler3 CVEs in the last year
- Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder2 CVEs in the last year
- FluentCart1 CVE in the last year
- Fluent Support1 CVE in the last year
- Fluent Booking1 CVE in the last year
- Best Payments Plugin for WP1 CVE in the last year
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.