CVE-2019-7299

Name of the Vulnerable Software and Affected Versions WP Support Plus Responsive Ticket System plugin version 9.1.1

Description A stored cross-site scripting issue in the submit ticket.php module allows remote attackers to inject arbitrary web script or HTML via the subject parameter in the /wp-content/plugins/wp-support-plus-responsive-ticket-system/includes/ajax/submit ticket.php endpoint.

Recommendations For WP Support Plus Responsive Ticket System plugin version 9.1.1, consider restricting access to the submit ticket.php module until a patch is available. As a temporary workaround, avoid using the subject parameter in the affected endpoint to minimize the risk of exploitation.