What is the CVSS score of EUVD-2026-48504?

EUVD-2026-48504 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Fluent Support EUVD-2026-48504

| CVE-2026-15665 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-24 Wordfence

GHSA-64jj-pfw2-rm5w

WordPress XSS Wordpress Plugin Fluent Support Helpdesk Customer Support Ticket System Wpmanageninja

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

4.4 MEDIUM

AC:H reflects the specific-browser and access-key preconditions; UI:R captures the victim's required keyboard action to fire the hidden-attribute payload.

3.1 AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 07:52 vuln.today

CVE Published

Jul 24, 2026 - 06:51 cve.org

MEDIUM 6.4

DescriptionCVE.org

The Fluent Support - Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'redirect-to' Shortcode Attribute in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The XSS payload is in a hidden attribute so it only fires in specific browsers when specific access keys are used making exploitation unlikely.

AnalysisAI

Stored Cross-Site Scripting in the Fluent Support WordPress plugin (all versions through 2.3.0) allows authenticated contributors to inject persistent JavaScript via the 'redirect-to' shortcode attribute due to missing input sanitization and output escaping in AuthHandler.php. The injected payload executes in the browser context of any user who subsequently visits the affected page, enabling session hijacking, credential theft, or administrative action forgery. Practical exploitation is significantly constrained: the payload resides in a hidden HTML attribute and only triggers in certain browsers when the victim activates specific keyboard access keys, making mass exploitation unlikely despite the network-accessible attack path. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog.

Technical ContextAI

The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS). The affected code resides in the plugin's AuthHandler.php file at multiple handler methods (lines 111, 149, 201, and 500 in the 2.3.0 tag). The 'redirect-to' parameter passed via a WordPress shortcode attribute is neither sanitized on input nor escaped on output, allowing raw HTML/JavaScript to be persisted in the database and later reflected into rendered pages. The CPE string cpe:2.3:a:wpmanageninja:fluent_support is the affected product. The unusual delivery mechanism - a hidden HTML attribute that depends on browser-specific access key processing - limits the payload's fire conditions to non-default user behavior and browser environments, which is atypical for stored XSS and is explicitly noted in the description as a primary exploitation barrier.

RemediationAI

Update the Fluent Support plugin to the version immediately following 2.3.0 once released via the WordPress plugin repository; the upstream fix is referenced in changeset 3609122 but an exact patched release version is not confirmed from available data - verify the current version in the WordPress admin plugin update interface. If an updated version is not yet available, site administrators should restrict contributor-level role assignment to trusted users only, as the vulnerability requires at minimum contributor access to exploit. Disabling shortcode processing for untrusted users via a capability filter (e.g., using the 'shortcode_atts' or role-gating filters) can serve as a compensating control, though this may affect legitimate plugin functionality. Given that exploitation requires specific browser access-key behavior, the residual risk for sites that cannot immediately patch is low; however, sites permitting open contributor registration face heightened exposure.