CVE-2026-15665

Name of the Vulnerable Software and Affected Versions Fluent Support – Helpdesk & Customer Support Ticket System versions prior to 2.3.1

Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting (XSS). This occurs via the redirect-to shortcode attribute, enabling the injection of arbitrary web scripts into pages that execute when accessed by a user. The payload is contained within a hidden attribute, which limits execution to specific browsers using specific access keys.

Recommendations Update to a version newer than 2.3.0. As a temporary mitigation, restrict the ability of users with contributor-level access to edit pages or use shortcodes.