Fluent Support <= 2.3.0 Authenticated Stored XSS via 'redirect-to' Shortcode (CVE-2026-15665)

Vulnerability Overview Vulnerability Name: Fluent Support <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'redirect-to' Shortcode Attribute CVE ID: CVE-2026-15665 CVSS Score: 6.4 (Medium) Publish Date: July 23, 2026 Last Updated: July 24, 2026 Researcher: Wordfence PRISM - Wordfence Impact Scope Software Type: Plugin Software Name: Fluent Support – Helpdesk & Customer Support Ticket System Affected Versions: <= 2.3.0 Fixed Version: 2.3.1 Remediation Recommendation: Upgrade to version 2.3.1 or later Vulnerability Description The Fluent Support – Helpdesk & Customer Support Ticket System plugin for WordPress contains a stored Cross-Site Scripting (XSS) vulnerability. Due to insufficient input validation in the 'redirect-to' shortcode attribute, authenticated attackers (Contributor level and above) can inject arbitrary scripts into pages. The XSS payload is hidden within the attribute and executes only in specific browsers when a specific access key is used. References plugins.trac.wordpress.org Additional Information Disclaimer: This record contains copyrighted material. Contact: For any questions or if you need more information, please contact wfi-support@wordfence.com Related Vulnerabilities Fluent Support <= 1.10.4 - Missing Authorization (CVE-2025-67926) Fluent Support <= 1.9.1 - Cross-Site Request Forgery (CVE-2025-57885) Fluent Support – Helpdesk & Customer Support Ticket System <= 1.8.5 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory (CVE-2024-13588) Fluent Support <= 1.8.0 - Authenticated (Subscriber+) SQL Injection (CVE-2024-47304) Fluent Support <= 1.8.0 - Insufficient Authorization on Email Verification (CVE-2024-47302) Fluent Support <= 1.7.6 - Authenticated(Administrator+) SQL Injection (CVE-2023-51547) Fluent Support <= 1.5.7 - Authenticated (Administrator+) SQL Injection (CVE-2022-2559) Additional Resources Wordfence Intelligence: Offers free personal and commercial API access, as well as free webhook integration. Wordfence WordPress Plugin: Installs and immediately notifies you if you are affected by the vulnerability. Contact Information Business Hours: 9am-8pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT (excluding weekends and holidays) Response Time: 24/7 support, with a 1-hour response time Legal Statement Copyright: © 2012-2026 Defiant Inc. All Rights Reserved Terms of Service: Terms of Service Privacy Policy: Privacy Policy and Notice at Collection Data Protection: Do Not Sell or Share My Personal Information Social Media Twitter: Wordfence Facebook: Wordfence LinkedIn: Wordfence Instagram: Wordfence Subscription Subscribe to News and Updates: Sign Up Other Links Products: Wordfence Free, Wordfence Premium, Wordfence Care, Wordfence Response, Wordfence CLI, Wordfence Intelligence, Wordfence Central Support: Documentation, Learning Center, Free Support, Premium Support News: Blog, In The News, Vulnerability Advisories About: About Wordfence, Affiliate Program, Employment, Contact, Security, CVE Request Form

Goal Reached Thanks to every supporter — we hit 100%!

Fluent Support <= 2.3.0 Authenticated Stored XSS via 'redirect-to' Shortcode (CVE-2026-15665)

More from this source