CVE-2026-15665 Overview
CVE-2026-15665 is a Stored Cross-Site Scripting (XSS) vulnerability in the Fluent Support – Helpdesk & Customer Support Ticket System plugin for WordPress. The flaw affects all versions up to and including 2.3.0. It exists in the redirect-to shortcode attribute, which lacks proper input sanitization and output escaping. Authenticated attackers with contributor-level access or above can inject arbitrary web scripts into WordPress pages. The injected payload executes when users access the affected page. The payload resides in a hidden HTML attribute, so it only fires in specific browsers when specific access keys are used.
Critical Impact
Contributor-level authenticated users can inject persistent JavaScript payloads that execute in the context of visiting users, though the hidden-attribute delivery vector makes exploitation unlikely in practice.
Affected Products
- Fluent Support – Helpdesk & Customer Support Ticket System plugin for WordPress
- All versions up to and including 2.3.0
- WordPress sites running the plugin with contributor-level or above user accounts
Discovery Timeline
- 2026-07-24 - CVE-2026-15665 published to NVD
- 2026-07-24 - Last updated in NVD database
Technical Details for CVE-2026-15665
Vulnerability Analysis
The vulnerability is a Stored Cross-Site Scripting flaw classified under [CWE-79]. It resides in the plugin's shortcode processing logic within AuthHandler.php. The plugin accepts a redirect-to attribute in a shortcode without sanitizing input or escaping output. Attacker-supplied content is persisted and later rendered into a hidden HTML attribute on pages that embed the shortcode.
Because the payload lives in a hidden attribute, it does not execute through normal page rendering. Execution requires a browser-specific behavior tied to access keys, which limits real-world exploitability. The vulnerability still meets the criteria for stored XSS because attacker-controlled JavaScript persists in the WordPress database and executes in another user's browser under the site's origin.
Root Cause
The root cause is insufficient input sanitization and missing output escaping in the shortcode handler in app/Hooks/Handlers/AuthHandler.php. The handler passes the redirect-to attribute directly into HTML output without applying WordPress escaping functions such as esc_attr() or esc_url(). This allows script content or HTML-breaking characters to reach the browser intact.
Attack Vector
Exploitation requires an authenticated account with contributor-level privileges or higher. The attacker creates or edits a post that embeds the vulnerable shortcode with a crafted redirect-to attribute containing a JavaScript payload. When a user later accesses the page and triggers the hidden-attribute activation condition, the script executes in their browser. This can lead to session token theft, forced actions in the victim's session, or privilege escalation if an administrator triggers the payload. Refer to the Wordfence Vulnerability Report and the WordPress Fluent Support Changeset for technical details.
Detection Methods for CVE-2026-15665
Indicators of Compromise
- Post or page content containing the Fluent Support shortcode with redirect-to attribute values that include <script>, javascript:, or HTML event handlers such as onerror and onclick.
- WordPress database entries in wp_posts where post content includes suspicious characters or encoded payloads within the redirect-to attribute.
- Unexpected outbound HTTP requests originating from browsers of authenticated WordPress administrators visiting content authored by lower-privilege accounts.
Detection Strategies
- Audit all posts and pages that reference Fluent Support shortcodes, and inspect the redirect-to parameter for encoded or scripted content.
- Correlate WordPress user role changes with recently authored content by contributor-level accounts to identify possible privilege escalation attempts.
- Deploy web application firewall (WAF) rules that flag shortcode parameters containing script tags, event handlers, or JavaScript URI schemes.
Monitoring Recommendations
- Monitor WordPress authentication logs for new contributor or author-level accounts created before the plugin is updated.
- Track modifications to posts and pages using site activity logs, and alert on shortcode attribute values containing HTML or script characters.
- Ingest WordPress and web server access logs into a centralized platform such as Singularity Data Lake to identify anomalous access patterns to affected pages.
How to Mitigate CVE-2026-15665
Immediate Actions Required
- Update the Fluent Support plugin to the patched version released after 2.3.0 as tracked in the WordPress Fluent Support Changeset.
- Audit all contributor-level and above accounts, and remove any that are inactive, unrecognized, or unnecessary.
- Review recently created or modified posts for shortcode attributes containing script content and remove malicious entries.
Patch Information
The plugin vendor addressed the vulnerability in the changeset referenced in the WordPress plugin repository. Site administrators should upgrade beyond version 2.3.0 through the WordPress admin dashboard or WP-CLI. Verify the installed version after the update by checking the plugin details page or querying the plugin metadata directly.
Workarounds
- Restrict contributor and author role assignments to trusted users only until the plugin is updated.
- Deploy a WAF rule that blocks requests containing script tags or JavaScript URI schemes in shortcode attributes.
- Temporarily disable the Fluent Support plugin if immediate patching is not possible and the shortcode is not required for business operations.
# Configuration example: update the plugin using WP-CLI
wp plugin update fluent-support
wp plugin get fluent-support --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
