title: CSRF in WP Fluent Forms < 3.6.67 allows stored XSS and Privilege Escalation
description: The WP Fluent Forms plugin < 3.6.67 for WordPress is vulnerable to Cross-Site Request Forgery leading to stored Cross-Site Scripting and limited Privilege Escalation due to a missing nonce check in the access control function for administrative AJAX actions
problem types: CWE-352 Cross-Site Request Forgery (CSRF)
affected:
{
product: WP Fluent Forms
vendor: WP Manage Ninja
versions:
lessThan: 3.6.67, status: affected, version: 3.6.67, versionType: custom
}