CVE-2026-11589

8.8 highEPSS 0.5%

High (8.8). EPSS 0.5% chance of exploitation in the next 30 days.

The WP Support Plus Responsive Ticket System WordPress plugin through 9.1.2 does not properly validate uploaded files, allowing unauthenticated users to upload files containing malicious JavaScript (such as HTML or SVG) to a publicly accessible location, leading to Stored Cross-Site Scripting attacks against site users and administrators.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 43% of CVEs (scores of 2026-10-31)
Published: 2026-06-30
Modified: 2026-06-30
Record from: the NVD, synced 2026-10-19

References

https://wpscan.com/vulnerability/c46479c2-4eef-485f-ae98-1f487efa4263/

Check your stack JSON