WordPress Plugin Vulnerabilities

WP Support Plus Responsive Ticket System <= 9.1.2 - Unauthenticated Stored XSS via File Upload

Description

The plugin does not properly validate uploaded files, allowing unauthenticated users to upload files containing malicious JavaScript (such as HTML or SVG) to a publicly accessible location, leading to Stored Cross-Site Scripting attacks against site users and administrators.

Proof of Concept

Affects Plugins

Plugin icon
wp-support-plus-responsive-ticket-system
No known fix

References

CVE
CVE-2026-11589

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
8.8 (high)

Miscellaneous

Original Researcher
Ayush Srivastava
Submitter
Ayush Srivastava
Verified
Yes
WPVDB ID
c46479c2-4eef-485f-ae98-1f487efa4263

Timeline

Publicly Published
2026-06-09 (about 1 month ago)
Added
2026-06-09 (about 1 month ago)
Last Updated
2026-07-20 (about 1 day ago)

Other

Published
Title
Published
2023-01-05
Title
CC Child Pages < 1.43 - Contributor+ Stored XSS via Shortcode
Published
2025-12-30
Title
Featured Video for WordPress – VideographyWP < 1.0.20 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2024-08-28
Title
PageLayer < 1.8.8 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published
2024-03-15
Title
WP Popups < 2.1.5.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published
2023-02-20
Title
Visualizer < 3.9.5 - Contributor+ Stored XSS