Fluent Support vulnerabilities

The Fluent Support plugin in versions up to and including 2.3.2 contains a Broken Access Control vulnerability exploitable by a Subscriber-level user. The flaw involves improper access control on plugin functionality.

The Fluent Support WordPress plugin before version 2.3.1 does not perform a per-ticket access check before reassigning a ticket's customer. A restricted support agent can change the assigned customer of any ticket in the system, including tickets outside their granted scope.

The Fluent Support plugin version 2.3.0 and earlier is vulnerable to XSS attacks from a contributor role. A user with contributor privileges can inject a malicious script.

Missing Authorization vulnerability in Shahjahan Jewel Fluent Support fluent-support allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Fluent Support: from n/a through <= 1.10.4.