Awesome Support vulnerabilities

Awesome Support plugin in versions up to and including 6.3.9 contains a Cross Site Scripting (XSS) vulnerability. It can be exploited by a subscriber-level user.

The Awesome Support – WordPress HelpDesk & Support Plugin is vulnerable to Stored Cross-Site Scripting via the 'wpas_files' parameter in all versions up to, and including, 6.4.1 due to insufficient input sanitization and output escaping. This allows authenticated attackers with custom-level access and above to inject arbitrary web scripts into pages that execute whenever a user accesses an injected page. This vulnerability is only exploitable when the "Enable drag-n-drop uploader for ticket form" setting is enabled, as it is disabled by default.

The Awesome Support plugin for WordPress up to version 6.3.9 has a missing authorization check in the wpas_do_mr_deny_user() function. Authenticated attackers with subscriber-level access and above can set the mr_user_denied flag on any user account, including administrators, permanently blocking their activation and sending a denial email.