CVE-2026-103370: Awesome Support <= 6.4.1 - Authenticated (Custom+) Stored Cross-Site Scripting via Ticket Attachment MIME Confusion
The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpasfiles' parameter in all versions up to, and including, 6.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the "Enable drag-n-drop uploader for ticket form" setting is enabled, as it is disabled by default.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable the “Enable drag-n-drop uploader for ticket form” setting; the vulnerability is exploitable when this setting is enabled.
Awesome Support – WordPress HelpDesk & Support Plugin Enable drag-n-drop uploader for ticket form = disabled
Event History
Frequently Asked Questions
Is a default installation affected?
Exploitation requires the "Enable drag-n-drop uploader for ticket form" setting to be enabled. That setting is disabled by default, so default configurations are not exploitable through this issue unless it has been enabled.
What access does an attacker need?
An attacker must be authenticated and have custom-level access or higher. They can use the wpas_files parameter to inject script content that executes when another user visits the affected page.
Which versions should be investigated?
All versions up to and including 6.4.1 are affected according to the provided data. Review installations running those versions, particularly where the drag-and-drop ticket uploader is enabled.
What can be done if patching is not immediately possible?
Disable the "Enable drag-n-drop uploader for ticket form" setting to remove the stated exploitation prerequisite. Also limit custom-level and higher accounts to trusted users until remediation is available.