Tarcísio Luchesi

The plugin fails to invalidate previously issued refresh tokens when a user changes their password, resets their password, or removes a connected device. This allows an attacker who has already obtained a refresh token to continue issuing valid access tokens, maintaining authenticated access to the account, which may include Administrator privileges.

Missing authorization in the `fluentformpro` component allows for the exploitation of incorrectly configured access control security levels, leading to broken access control.

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access and above can inject arbitrary web scripts into pages, which execute when a user accesses the affected page.

Unauthenticated users can inject arbitrary HTML into password-reset emails sent to registered users. This occurs because the plugin fails to sanitize or escape the email subject and body values provided in a request before including them in the HTML message, which could facilitate phishing attacks.

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts into pages, which execute when a user accesses the affected page.