CVE-2026-96820

HighCVSS 7.1

Published: 30/09/2026(UTC)Updated: 30/09/2026(UTC)Translated: 30/09/2026(UTC)NVD NIST

Summary

Awesome Support plugin in versions up to and including 6.3.9 contains a Cross Site Scripting (XSS) vulnerability. It can be exploited by a subscriber-level user.

Risk Assessment

A subscriber can inject a malicious script that executes in other users' browsers, potentially leading to session or data theft.

Recommendation

Update the Awesome Support plugin to a version newer than 6.3.9. Consider deploying a WAF filtering XSS attempts.

Other vulnerabilities in Awesome Support

CVE-2026-19946Medium
The Awesome Support plugin for WordPress up to version 6.3.9 has a missing authorization check in the wpas_do_mr_deny_user() function. Authenticated attackers with subscriber-level access and above can set the mr_user_denied flag on any user account, including administrators, permanently blocking their activation and sending a denial email.

Original NVD description (English source)

Subscriber Cross Site Scripting (XSS) in Awesome Support <= 6.3.9 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS