Stored Cross-Site Scripting Vulnerability in Awesome Support Plugin for WordPress

CVE-2026-103370

What is CVE-2026-103370?

The Awesome Support plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability through the 'wpas_files' parameter, affecting all versions up to and including 6.4.1. This issue arises from inadequate input sanitization and output escaping, allowing authenticated attackers with custom-level access and above to inject arbitrary web scripts. These scripts could execute when users access affected pages, particularly when the 'Enable drag-n-drop uploader for ticket form' setting is activated. As this setting is off by default, users should carefully consider its implications.

References