Stored Cross-Site Scripting in Awesome Support Plugin for WordPress
CVE-2026-96268

6.4MEDIUM

Key Information:

Vendor

WordPress
Status
Awesome Support – WordPress Helpdesk & Support Plugin
Vendor
CVE Published:
1 October 2026

What is CVE-2026-96268?

The Awesome Support plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping via the 'gdpr-data' parameter. This vulnerability enables authenticated attackers with subscriber-level access and above to inject arbitrary web scripts into pages. These scripts execute whenever a user accesses the compromised page. The AJAX handlers inadequately verify 'gdpr-user' IDs, allowing Subscriber-level users to manipulate the content and potentially exploit other accounts. The emitted nonce via wp_localize_script further exposes all logged-in users to risk, making this a significant concern for site administrators.

Affected Version(s)

Awesome Support – WordPress HelpDesk & Support Plugin 0 <= 6.4.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/awesome-suppor...
https://plugins.trac.wordpress.org/browser/awesome-suppor...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nhien Pham (nhienit) (nhienit)
.