awesomesupport has 4 CVEs on record. 4 were published in the last 90 days. The median CVSS is 6.4 (medium). The most common weakness class is CWE-79 (3). Most affected products: Awesome Support – WordPress HelpDesk & Support Plugin (3), awesome-support (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.4
- Publish → KEV
- —
- Last 90 days
- 4 prev 0
Products
- Awesome Support – WordPress HelpDesk & Support Plugin 3
- awesome-support 1
Worst active — by depth score
CVE-2026-96820High· 7.1Subscriber Cross Site Scripting (XSS) in Awesome Support <= 6.3.9 versions.39CVE-2026-103370Medium· 6.4Awesome Support <= 6.4.1 - Authenticated (Custom+) Stored Cross-Site Scripting via Ticket Attachment MIME Confusion35CVE-2026-96268Medium· 6.4The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gdpr-data' parameter in all versions up to, and including, 6.4.0 due to insufficient input sanitization …35CVE-2026-19946Medium· 4.3Awesome Support <= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Denial via 'user_id' Parameter24
awesomesupport vulnerabilities
CVEs affecting awesomesupport, newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
CVE-2026-103370Medium· 6.4Awesome Support <= 6.4.1 - Authenticated (Custom+) Stored Cross-Site Scripting via Ticket Attachment MIME Confusion
The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpas_files' parameter in all versions up to, and including, 6.4.1 due to insufficient input sanitization…
CVE-2026-96268Medium· 6.4The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gdpr-data' parameter in all versions up to, and including, 6.4.0 due to insufficient input sanitization …
The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gdpr-data' parameter in all versions up to, and including, 6.4.0 due to insufficient input sanitization …
CVE-2026-96820High· 7.1Subscriber Cross Site Scripting (XSS) in Awesome Support <= 6.3.9 versions.
Subscriber Cross Site Scripting (XSS) in Awesome Support <= 6.3.9 versions.
CVE-2026-19946Medium· 4.3Awesome Support <= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Denial via 'user_id' Parameter
The Awesome Support plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 6.3.9. This is due to a missing capability check on the wpas_do_mr_deny_user() function, which unlike its counterpart wpas_…