Fluent Support <= 2.3.0 Authenticated Stored XSS via 'redirect-to' Shortcode (CVE-2026-15665)

漏洞概述 漏洞名称: Fluent Support <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'redirect-to' Shortcode Attribute CVE ID: CVE-2026-15665 CVSS 评分: 6.4 (Medium) 发布日期: 2026年7月23日 最后更新日期: 2026年7月24日 研究人员: Wordfence PRISM - Wordfence 影响范围 软件类型: Plugin 软件名称: Fluent Support – Helpdesk & Customer Support Ticket System 受影响版本: <= 2.3.0 已修复版本: 2.3.1 修复方案 修复建议: 升级到版本 2.3.1 或更高版本 漏洞描述 Fluent Support – Helpdesk & Customer Support Ticket System 插件在 WordPress 中存在存储型跨站脚本（XSS）漏洞。该漏洞通过 'redirect-to' 短代码属性中的输入验证不足，允许经过身份验证的攻击者（贡献者级别及以上）在页面中注入任意脚本。XSS 载荷隐藏在属性中，仅在特定浏览器中执行，当特定访问密钥被使用时。 参考链接 plugins.trac.wordpress.org 其他信息 免责声明: 该记录包含受版权保护的材料。 联系方式: 如有任何疑问或需要更多信息，请联系 wfi-support@wordfence.com 近期漏洞 Fluent Support <= 1.10.4 - Missing Authorization (CVE-2025-67926) Fluent Support <= 1.9.1 - Cross-Site Request Forgery (CVE-2025-57885) Fluent Support – Helpdesk & Customer Support Ticket System <= 1.8.5 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory (CVE-2024-13588) Fluent Support <= 1.8.0 - Authenticated (Subscriber+) SQL Injection (CVE-2024-47304) Fluent Support <= 1.8.0 - Insufficient Authorization on Email Verification (CVE-2024-47302) Fluent Support <= 1.7.6 - Authenticated(Administrator+) SQL Injection (CVE-2023-51547) Fluent Support <= 1.5.7 - Authenticated (Administrator+) SQL Injection (CVE-2022-2559) 其他资源 Wordfence Intelligence: 提供免费的个人和商业 API 访问，以及免费的 webhook 集成。 Wordfence WordPress 插件: 安装后可立即通知您是否受到漏洞影响。 联系方式 业务时间: 9am-8pm ET, 6am-5pm PT 和 2pm-1am UTC/GMT（不包括周末和节假日） 响应时间: 24小时支持，全年无休，1小时响应时间 法律声明 版权: © 2012-2026 Defiant Inc. All Rights Reserved 服务条款: Terms of Service 隐私政策: Privacy Policy and Notice at Collection 数据保护: Do Not Sell or Share My Personal Information 社交媒体 Twitter: Wordfence Facebook: Wordfence LinkedIn: Wordfence Instagram: Wordfence 订阅 订阅新闻和更新: Sign Up 其他链接 产品: Wordfence Free, Wordfence Premium, Wordfence Care, Wordfence Response, Wordfence CLI, Wordfence Intelligence, Wordfence Central 支持: Documentation, Learning Center, Free Support, Premium Support 新闻: Blog, In The News, Vulnerability Advisories 关于: About Wordfence, Affiliate Program, Employment, Contact, Security, CVE Request Form 免责声明 免责声明: 该记录包含受版权保护的材料。 联系方式: 如有任何疑问或需要更多信息，请联系 wfi-support@wordfence.com 近期漏洞 Fluent Support <= 1.10.4 - Missing Authorization (CVE-2025-67926) Fluent Support <= 1.9.1 - Cross-Site Request Forgery (CVE-2025-57885) Fluent Support – Helpdesk & Customer Support Ticket System <= 1.8.5 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory (CVE-2024-13588) Fluent Support <= 1.8.0 - Authenticated (Subscriber+) SQL Injection (CVE-2024-47304) Fluent Support <= 1.8.0 - Insufficient Authorization on Email Verification (CVE-2024-47302) Fluent Support <= 1.7.6 - Authenticated(Administrator+) SQL Injection (CVE-2023-51547) Fluent Support <= 1.5.7 - Authenticated (Administrator+) SQL Injection (CVE-2022-2559) 其他资源 Wordfence Intelligence: 提供免费的个人和商业 API 访问，以及免费的 webhook 集成。 Wordfence WordPress 插件: 安装后可立即通知您是否受到漏洞影响。 联系方式 业务时间: 9am-8pm ET, 6am-5pm PT 和 2pm-1am UTC/GMT（不包括周末和节假日） 响应时间: 24小时支持，全年无休，1小时响应时间 法律声明 版权: © 2012-2026 Defiant Inc. All Rights Reserved 服务条款: Terms of Service 隐私政策: Privacy Policy and Notice at Collection 数据保护: Do Not Sell or Share My Personal Information 社交媒体 Twitter: Wordfence Facebook: Wordfence LinkedIn: Wordfence Instagram: Wordfence 订阅 订阅新闻和更新: Sign Up 其他链接 产品: Wordfence Free, Wordfence Premium, Wordfence Care, Wordfence Response, Wordfence CLI, Wordfence Intelligence, Wordfence Central 支持: Documentation, Learning Center, Free Support, Premium Support 新闻: Blog, In The News, Vulnerability Advisories 关于: About Wordfence, Affiliate Program, Employment, Contact, Security, CVE Request Form 免责声明 免责声明: 该记录包含受版权保护的材料。 联系方式: 如有任何疑问或需要更多信息，请联系 wfi-support@wordfence.com 近期漏洞 Fluent Support <= 1.10.4 - Missing Authorization (CVE-2025-67926) Fluent Support <= 1.9.1 - Cross-Site Request Forgery (CVE-2025-57885) Fluent Support – Helpdesk & Customer Support Ticket System <= 1.8.5 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory (CVE-2024-13588) Fluent Support <= 1.8.0 - Authenticated (Subscriber+) SQL Injection (CVE-2024-47304) Fluent Support <= 1.8.0 - Insufficient Authorization on Email Verification (CVE-2024-47302) Fluent Support <= 1.7.6 - Authenticated(Administrator+) SQL Injection (CVE-2023-51547) Fluent Support <= 1.5.7 - Authenticated (Administrator+) SQL Injection (CVE-2022-2559) 其他资源 Wordfence Intelligence: 提供免费的个人和商业 API 访问，以及免费的 webhook 集成。 Wordfence WordPress 插件: 安装后可立即通知您是否受到漏洞影响。 联系方式 业务时间: 9am-8pm ET, 6am-5pm PT 和 2pm-1am UTC/GMT（不包括周末和节假日） 响应时间: 24小时支持，全年无休，1小时响应时间 法律声明 版权: © 2012-2026 Defiant Inc. All Rights Reserved 服务条款: Terms of Service 隐私政策: Privacy Policy and Notice at Collection 数据保护: Do Not Sell or Share My Personal Information 社交媒体 Twitter: Wordfence Facebook: Wordfence LinkedIn: Wordfence Instagram: Wordfence 订阅 订阅新闻和更新: Sign Up 其他链接 产品: Wordfence Free, Wordfence Premium, Wordfence Care, Wordfence Response

目標達成すべての支援者に感謝 — 100%達成しました！

Fluent Support <= 2.3.0 Authenticated Stored XSS via 'redirect-to' Shortcode (CVE-2026-15665)

このソースからの他の記事

目標達成 すべての支援者に感謝 — 100%達成しました！

Fluent Support <= 2.3.0 Authenticated Stored XSS via 'redirect-to' Shortcode (CVE-2026-15665)

このソースからの他の記事

目標達成すべての支援者に感謝 — 100%達成しました！