CVE-2026-96820
HighCVSS 7.1Summary
Awesome Support plugin in versions up to and including 6.3.9 contains a Cross Site Scripting (XSS) vulnerability. It can be exploited by a subscriber-level user.
Risk Assessment
A subscriber can inject a malicious script that executes in other users' browsers, potentially leading to session or data theft.
Recommendation
Update the Awesome Support plugin to a version newer than 6.3.9. Consider deploying a WAF filtering XSS attempts.
Other vulnerabilities in Awesome Support
See all- CVE-2026-103370Medium
The Awesome Support – WordPress HelpDesk & Support Plugin is vulnerable to Stored Cross-Site Scripting via the 'wpas_files' parameter in all versions up to, and including, 6.4.1 due to insufficient input sanitization and output escaping. This allows authenticated attackers with custom-level access and above to inject arbitrary web scripts into pages that execute whenever a user accesses an injected page. This vulnerability is only exploitable when the "Enable drag-n-drop uploader for ticket form" setting is enabled, as it is disabled by default.
- CVE-2026-19946Medium
The Awesome Support plugin for WordPress up to version 6.3.9 has a missing authorization check in the wpas_do_mr_deny_user() function. Authenticated attackers with subscriber-level access and above can set the mr_user_denied flag on any user account, including administrators, permanently blocking their activation and sending a denial email.
Original NVD description (English source)
Subscriber Cross Site Scripting (XSS) in Awesome Support <= 6.3.9 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS