CVE-2026-65470
MediumCVSS 6.5Summary
The Fluent Support plugin version 2.3.0 and earlier is vulnerable to XSS attacks from a contributor role. A user with contributor privileges can inject a malicious script.
Risk Assessment
The risk includes potential script execution in an administrator's or other users' browser, which could lead to session theft or content modification.
Recommendation
It is recommended to update the Fluent Support plugin to a version above 2.3.0 that includes an XSS fix.
Other vulnerabilities in Fluent Support
See all- CVE-2026-94679Medium
The Fluent Support plugin in versions up to and including 2.3.2 contains a Broken Access Control vulnerability exploitable by a Subscriber-level user. The flaw involves improper access control on plugin functionality.
- CVE-2026-14197Low
The Fluent Support WordPress plugin before version 2.3.1 does not perform a per-ticket access check before reassigning a ticket's customer. A restricted support agent can change the assigned customer of any ticket in the system, including tickets outside their granted scope.
Original NVD description (English source)
Contributor Cross Site Scripting (XSS) in Fluent Support <= 2.3.0 versions.