CVE-2025-15549 MEDIUM

CVE-2025-15549: FluentCMS 2026 Stored XSS via SVG Upload in File Management

Vendor Fluentcms

Product FluentCMS

Weakness CWE-79 · XSS

Published January 29, 2026

Last update May 12, 2026

View on NVD All CVEs

CVSS base score

4.8/10

Attack vector Network

Attack complexity Low

Privileges required High

User interaction —

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

What the vulnerability does

01Description

FluentCMS 2026 contains a stored cross-site scripting vulnerability that allows authenticated administrators to upload SVG files with embedded JavaScript via the File Management module. Attackers can upload malicious SVG files that execute JavaScript in the browser of any user accessing the uploaded file URL.

Key dates

02Disclosure timeline

January 29, 2026 CVE published

May 12, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-15549 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2024-47363 WordPress Blockspare plugin <= 3.2.4 - Cross Site Scripting (XSS) vulnerability CVE-2026-7001 Datacom DM4100 Ethernet Configuration cross site scripting CVE-2024-30430 WordPress FluentCRM plugin <= 2.8.44 - Cross Site Scripting (XSS) vulnerability CVE-2023-35918 WordPress WooCommerce Bulk Stock Management Plugin <= 2.2.33 is vulnerable to Cross Site Scripting (XSS) CVE-2026-42688 WordPress Modula Image Gallery plugin <= 2.14.23 - Cross Site Scripting (XSS) vulnerability