Fluent Support CVE-2026-65470

Exploitation requires the attacker to hold a Contributor-level (or equivalent low-privilege) WordPress account on the target site - this is confirmed by PR:L in the CVSS vector. A victim with higher privileges (e.g., WordPress Administrator or Editor) must subsequently view the page or content element where the payload was injected, as required by UI:R. The Fluent Support plugin must be installed, active, and running version 2.3.0 or earlier. Exploitation is limited by the need for an authenticated contributor account, meaning unauthenticated attackers cannot directly exploit this; and by the requirement for admin interaction with poisoned content, meaning exploitation is not fully automated. Non-default conditions: environments where Contributor role is entirely unused or where admin review of support tickets is disabled are not exposed in practice.

The CVSS 6.5 score reflects a moderate-to-medium real-world priority. The PR:L metric confirms exploitation requires at minimum a Contributor-level WordPress account, which meaningfully limits opportunistic mass exploitation - unauthenticated attackers cannot trigger this directly. UI:R further constrains the attack: a privileged user must navigate to and render the poisoned content. However, S:C elevates the effective impact because the payload targets the admin's browser session rather than just the contributor's. No EPSS data was provided in the intelligence, so probabilistic exploitation likelihood cannot be quantified here. The vulnerability is not listed in CISA KEV, and no POC is referenced in available sources, suggesting exploitation remains theoretical or private at time of writing. The primary real-world risk is in multi-tenant or SaaS WordPress environments where untrusted contributors are routinely granted plugin access, and where admins frequently review support queue entries - a plausible workflow in the plugin's intended use case. CVSS indicates network vector but the attack still requires an authenticated session, so treat CVSS 6.5 as the ceiling rather than the floor of urgency.

An attacker who has registered or been granted a Contributor account on the target WordPress site injects a crafted JavaScript payload (e.g., a cookie-stealing or admin-action script) into a Fluent Support ticket field or other contributor-accessible input. When a site administrator opens the support dashboard and views the submission, the payload executes silently in the admin's authenticated browser session, potentially exfiltrating the admin session cookie to an attacker-controlled endpoint or performing privileged actions on the administrator's behalf. No public POC has been identified, but the attack pattern is well-understood for stored XSS with scope change.