CVE-2026-15665 in Fluent Support Plugin
Summary
by MITRE • 07/24/2026
The Fluent Support – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'redirect-to' Shortcode Attribute in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The XSS payload is in a hidden attribute so it only fires in specific browsers when specific access keys are used making exploitation unlikely.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/24/2026
The Fluent Support plugin for WordPress represents a critical security vulnerability through a stored cross-site scripting flaw that affects versions up to and including 2.3.0. This vulnerability specifically targets the 'redirect-to' shortcode attribute, creating a persistent threat vector that allows authenticated attackers with contributor-level permissions or higher to inject malicious scripts into the system. The flaw resides in the insufficient sanitization of user input and inadequate output escaping mechanisms, which together create an environment where attacker-controlled content can be stored and subsequently executed without proper validation.
The technical implementation of this vulnerability demonstrates a classic stored XSS pattern where malicious payloads are injected into the plugin's shortcode processing functionality. When an authenticated user with appropriate privileges creates or modifies content containing the vulnerable 'redirect-to' attribute, the script gets stored within the WordPress database. Subsequently, whenever any user accesses pages containing this stored content, the malicious script executes in their browser context. This represents a significant risk because it leverages the trust relationship between the WordPress system and its users, allowing attackers to bypass normal security boundaries through legitimate administrative functions.
The operational impact of this vulnerability extends beyond simple script execution, as it provides attackers with potential access to sensitive user data and system functionality. Since contributors and above have elevated privileges within WordPress, successful exploitation could enable attackers to manipulate support tickets, access confidential customer information, or even escalate their privileges further within the application. The vulnerability's design makes it particularly dangerous because it can remain dormant until triggered by specific browser behaviors or keyboard shortcuts, making detection more challenging for system administrators and security monitoring tools.
The security implications of this flaw align with CWE-79 which categorizes cross-site scripting vulnerabilities as a fundamental web application security weakness. From an adversary perspective, this vulnerability fits within the ATT&CK framework's technique T1059.007 for Command and Scripting Interpreter, specifically targeting web shells or browser-based attacks through user interaction patterns. The hidden nature of the XSS payload in the redirect-to attribute creates a unique exploitation scenario where attackers must understand specific browser behaviors to trigger execution, though this reduced likelihood does not eliminate the threat level.
Mitigation strategies should focus on immediate remediation through plugin updates to versions that address the sanitization and escaping deficiencies. System administrators should implement additional security layers including content security policies that restrict script execution, regular monitoring of user-generated content for suspicious patterns, and comprehensive user access controls to limit contributor-level privileges where possible. The vulnerability also highlights the importance of input validation and output escaping practices in WordPress plugin development, particularly for shortcode attributes that process external user input. Organizations should conduct thorough security audits of their installed plugins, implement automated scanning tools to detect similar vulnerabilities, and maintain up-to-date security monitoring procedures to identify potential exploitation attempts before they succeed.