CVE-2024-30430 in Fluent CRM Plugin
Summary
by MITRE • 03/29/2024
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Email Newsletter Team - FluentCRM Fluent CRM allows Stored XSS.This issue affects Fluent CRM: from n/a through 2.8.44.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 04/10/2025
The CVE-2024-30430 vulnerability represents a critical cross-site scripting flaw within the WP Email Newsletter Team - FluentCRM plugin ecosystem, specifically impacting versions through 2.8.44. This vulnerability falls under the CWE-79 category of Cross-Site Scripting, where malicious input is improperly sanitized during web page generation processes. The flaw enables attackers to inject malicious scripts into web pages viewed by other users, creating a persistent security risk that can affect multiple users within the same system. The vulnerability specifically manifests as a stored XSS attack vector, meaning that malicious payloads are stored on the server and executed whenever affected pages are accessed by legitimate users.
The technical exploitation of this vulnerability occurs when administrators or users interact with web forms or input fields within the FluentCRM plugin interface. When user-supplied data containing malicious script code is processed and stored without proper sanitization, the system fails to neutralize potentially dangerous input elements such as script tags, event handlers, or other malicious code patterns. This improper input handling during web page generation creates an environment where attackers can embed malicious JavaScript code that executes in the context of other users' browsers. The stored nature of this vulnerability means that once injected, the malicious payload remains persistent and continues to affect users until manually removed from the system.
The operational impact of CVE-2024-30430 extends beyond simple data theft or session hijacking, as it provides attackers with the capability to perform a wide range of malicious activities within the compromised environment. Attackers can leverage this vulnerability to steal administrator credentials, manipulate user data, redirect users to malicious websites, or even escalate privileges within the WordPress environment. The vulnerability's presence in the email newsletter functionality of FluentCRM creates additional attack surface since email campaigns often contain user interaction elements that could be exploited. This issue directly maps to ATT&CK technique T1566.001 for initial access through spearphishing attachments and T1071.001 for application layer protocol usage, as attackers can leverage the XSS vulnerability to establish persistent access and exfiltrate data through legitimate email channels.
Organizations affected by this vulnerability should implement immediate mitigations including updating to the latest version of the FluentCRM plugin where the XSS vulnerability has been patched, implementing proper input validation and output encoding mechanisms, and conducting thorough security audits of all user-input fields within the WordPress environment. The recommended approach includes deploying web application firewalls that can detect and block malicious script payloads, implementing Content Security Policy headers to restrict script execution, and establishing regular security monitoring procedures to detect potential exploitation attempts. Additionally, administrators should consider role-based access controls to limit who can submit content that might be stored in the system, as well as implementing regular backups and monitoring for unauthorized modifications to email templates and campaign content. Security teams should also review and update their incident response procedures to address potential XSS-related breaches and ensure proper containment and remediation processes are in place for similar vulnerabilities.