Awesome Support <= 6.4.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Ticket Attachment MIME Type Confusion
- ID
- WPSEC-2026-1143
- Plugin
- Awesome Support – WordPress HelpDesk & Support Plugin (awesome-support)
- Affected
- all versions before 6.4.2
- Remediation
- Update to 6.4.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-16
- Attack surface
- Awesome Support on WPSec AttackSurface
- Fix released
- Published
Description
The Awesome Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via ticket attachments uploaded with the drag-and-drop (AJAX) uploader in all versions up to, and including, 6.4.1, due to the attachment MIME type being taken from the file contents (mime_content_type()) instead of the allowed file extension, and attachments being served inline by the wpas-attachment endpoint with that stored Content-Type and without an X-Content-Type-Options: nosniff header. This makes it possible for authenticated attackers, with subscriber-level access and above who are allowed to attach files to tickets, to upload a file with an allowed extension (such as .png) that contains HTML and JavaScript. The script runs in the site's origin when an agent, administrator or other user opens the attachment. The drag-and-drop uploader must be enabled, and it is off by default.
References
- https://wpsec.com/vuln/WPSEC-2026-1143/
- https://plugins.svn.wordpress.org/awesome-support/tags/6.4.2/
- https://wordpress.org/plugins/awesome-support/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS