Fluent Support vulnerabilities

The Fluent Support plugin in versions up to and including 2.3.2 contains a Broken Access Control vulnerability exploitable by a Subscriber-level user. The flaw involves improper access control on plugin functionality.

The Fluent Support plugin version 2.3.0 and earlier is vulnerable to XSS attacks from a contributor role. A user with contributor privileges can inject a malicious script.

The Fluent Support WordPress plugin before version 2.3.1 does not perform a per-ticket access check before reassigning a ticket's customer. A restricted support agent can change the assigned customer of any ticket in the system, including tickets outside their granted scope.