What is the CVSS score of CVE-2026-65470?

CVE-2026-65470 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Fluent Support CVE-2026-65470

EUVD-2026-48082 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-23 Patchstack

GHSA-3p9v-cwqh-2mxm

WordPress XSS Fluent Support Wordpress Plugin Wpmanageninja

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

5.4 MEDIUM

Contributor auth (PR:L) and admin interaction (UI:R) required; scope change applies but XSS does not cause availability impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:24 vuln.today

DescriptionCVE.org

Contributor Cross Site Scripting (XSS) in Fluent Support <= 2.3.0 versions.

AnalysisAI

Stored Cross-Site Scripting in Fluent Support (WordPress plugin by WPManageNinja) versions up to and including 2.3.0 allows a Contributor-level authenticated attacker to inject persistent malicious JavaScript into support-related content. Because the CVSS vector carries S:C (scope change), the payload executes in the browser context of higher-privileged users - such as administrators - who subsequently view the injected content, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Technical ContextAI

Fluent Support is a WordPress helpdesk and customer support plugin developed by WPManageNinja (CPE: cpe:2.3:a:wpmanageninja:fluent_support:*:*:*:*:*:*:*:*). CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause: user-supplied input from a Contributor-role account is stored and later rendered in a page without sufficient output encoding or sanitization, allowing HTML/JavaScript injection. The 'Contributor' vector is significant in WordPress environments because Contributor is a low-trust role typically granted to external content authors, meaning the attack surface is wider than vulnerabilities requiring Editor or Administrator access. The S:C metric in the CVSS vector confirms the injected script executes in a security context different from where it was introduced - specifically the browser session of an admin or other privileged user who renders the tainted content.

RemediationAI

The primary remediation is to update the Fluent Support WordPress plugin to a version beyond 2.3.0 via the WordPress plugin dashboard or direct download from the WPManageNinja repository. The exact patched version is not independently confirmed from the available input data - the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/fluent-support/vulnerability/wordpress-fluent-support-plugin-2-3-0-cross-site-scripting-xss-vulnerability should be consulted for the confirmed fix release. If immediate patching is not possible, a compensating control is to audit and revoke Contributor-level access to the plugin from untrusted accounts, since PR:L is the enabling condition for exploitation. Additionally, a Web Application Firewall (WAF) with XSS ruleset - such as Patchstack's virtual patching or Wordfence - can block known XSS payloads in transit, though this is not a substitute for patching. Note that restricting Contributor access may impact legitimate content workflows in environments relying on that role.