Advisories · Technology

techjewel Fluent Forms Pro Add On Pack.

Every CVE that names techjewel Fluent Forms Pro Add On Pack among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-15962 CVE record

CVSS 8.8 High

Fluent Forms Pro Add On Pack <= 6.2.6 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary User Password Change via User Meta Field
- techjewel Fluent Forms Pro Add On Pack
- Insecure deserialization
Not analysed yet 26 Jul 2026
CVE-2026-2899 CVE record

CVSS 6.5 Medium

Fluent Forms Pro Add On Pack <= 6.1.17 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion
- techjewel Fluent Forms Pro Add On Pack
- Broken access control
Not analysed yet 5 Mar 2026
CVE-2026-2365 CVE record

CVSS 7.2 High

Fluent Forms Pro <= 6.1.17 - Unauthenticated Stored Cross-Site Scripting via Draft Form Submission
- techjewel Fluent Forms Pro Add On Pack
- Cross-site scripting (XSS)
Not analysed yet 5 Mar 2026
CVE-2026-2428 CVE record

CVSS 7.5 High

Fluent Forms Pro Add On Pack <= 6.1.17 - Missing Authorization to Unauthenticated Payment Status modification
- techjewel Fluent Forms Pro Add On Pack
- CWE-345
Not analysed yet 27 Feb 2026
CVE-2026-0632 CVE record

CVSS 5.4 Medium

Fluent Forms Pro Add On Pack <= 6.1.12 - Authenticated (Subscriber+) Server-Side Request Forgery via 'saveDataSource'
- techjewel Fluent Forms Pro Add On Pack
- Server-side request forgery (SSRF)
Not analysed yet 9 Feb 2026