Unknown Fluentboards vulnerabilities

5 CVEs affecting Unknown Fluentboards, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-89331, published 2026-09-23.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-85349, published 2026-09-16. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. The FluentBoards WordPress plugin before 2.0.15 does not properly verify authorization when returning the list of boards a user belongs to, allowing any authenticated user, including a Subscriber…
CVE-2026-14938, published 2026-08-02. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. The FluentBoards WordPress plugin before 1.95.3 does not verify that the items selected for a board import operation belong to a board the requesting user is authorized to access, allowing any…
CVE-2026-89328, published 2026-09-16. Low severity, CVSS 3.8. EPSS: 0.3% chance of exploitation in the next 30 days. The FluentBoards WordPress plugin before 2.0.15 does not properly verify that a user holds board-manager privileges before performing several board-management operations, checking only board…
CVE-2026-89327, published 2026-09-16. Low severity, CVSS 3.8. EPSS: 0.3% chance of exploitation in the next 30 days. The FluentBoards WordPress plugin before 2.0.15 does not verify that a board member submitting a comment is the user the comment is attributed to, allowing any board member to post comments that…
CVE-2026-89331, published 2026-09-23. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. The FluentBoards WordPress plugin before 2.1.0 does not properly restrict the member data returned by its public, token-shared board feature, allowing unauthenticated users to disclose the email…