CVE-2026-96268

Name of the Vulnerable Software and Affected Versions Awesome Support – WordPress HelpDesk & Support Plugin versions prior to 6.4.1

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access or higher can inject arbitrary web scripts into pages. These scripts execute when a user accesses the affected page. The issue exists because AJAX handlers accept an arbitrary gdpr-data parameter without verifying if the associated user ID belongs to the requester. Additionally, the required wpas-gdpr-nonce is exposed to all logged-in users via wp localize script on frontend plugin pages and the /wp-admin/profile.php endpoint.

Recommendations Update Awesome Support – WordPress HelpDesk & Support Plugin to version 6.4.1 or later. Avoid using the gdpr-data parameter in AJAX requests until the plugin is updated.