CVE-2026-96268

MediumCVSS 6.4

Published: 01/10/2026(UTC)Updated: 01/10/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

9th percentile - higher than 9% of all known CVEs

Summary

The Awesome Support – WordPress HelpDesk & Support Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gdpr-data' parameter in all versions up to, and including, 6.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by Subscriber-level users against other accounts because the AJAX handlers accept an arbitrary gdpr-user ID without verifying it belongs to the requester, and the required wpas-gdpr-nonce is emitted via wp_localize_script to every logged-in user on frontend plugin pages and on /wp-admin/profile.php.

Risk Assessment

An attacker can inject malicious scripts that execute in other users' browsers, potentially leading to session theft, account takeover, or malware distribution.

Recommendation

Update the Awesome Support plugin to the latest version with security fixes and restrict subscriber-level access.

Other vulnerabilities in Awesome Support – WordPress HelpDesk & Support Plugin

CVE-2026-4654Medium
The Awesome Support plugin for WordPress up to version 6.3.7 contains an Insecure Direct Object Reference vulnerability. The wpas_get_ticket_replies_ajax() function fails to verify if the authenticated user has permission to view the specific ticket, allowing attackers with subscriber-level access or higher to access sensitive information from all tickets.

Original NVD description (English source)

The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gdpr-data' parameter in all versions up to, and including, 6.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by Subscriber-level users against other accounts because the AJAX handlers accept an arbitrary gdpr-user ID without verifying it belongs to the requester, and the required wpas-gdpr-nonce is emitted via wp_localize_script to every logged-in user on frontend plugin pages and on /wp-admin/profile.php.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS