CVE-2026-11589
WP Support Plus Responsive Ticket System <= 9.1.2 - Unauthenticated Stored XSS via File Upload
- State
- Published
- Severity
- 8.8 High
- Published
- Jun 30, 2026
- Updated
- Jun 30, 2026
- Reserved
- Jun 8, 2026
Description
The WP Support Plus Responsive Ticket System WordPress plugin through 9.1.2 does not properly validate uploaded files, allowing unauthenticated users to upload files containing malicious JavaScript (such as HTML or SVG) to a publicly accessible location, leading to Stored Cross-Site Scripting attacks against site users and administrators.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.8 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | CISA-ADP |
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
WP Support Plus Responsive Ticket SystemUnknown |
|
References
- https://wpscan.com/vulnerability/c46479c2-4eef-485f-ae98-1f487efa4263/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.