# Awesome Support <= 6.4.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Ticket Attachment MIME Type Confusion

- **ID:** WPSEC-2026-1143
- **Plugin:** Awesome Support – WordPress HelpDesk & Support Plugin (`awesome-support`), https://wordpress.org/plugins/awesome-support/
- **Affected versions:** all versions before 6.4.2
- **Fixed in:** 6.4.2 (Update to 6.4.2 or later.)
- **Severity:** Medium 4.9 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-16)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/awesome-support
- **Fix released:** 2026-10-16
- **Published:** 2026-10-17
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1143/

## Description

The Awesome Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via ticket attachments uploaded with the drag-and-drop (AJAX) uploader in all versions up to, and including, 6.4.1, due to the attachment MIME type being taken from the file contents (mime_content_type()) instead of the allowed file extension, and attachments being served inline by the wpas-attachment endpoint with that stored Content-Type and without an X-Content-Type-Options: nosniff header. This makes it possible for authenticated attackers, with subscriber-level access and above who are allowed to attach files to tickets, to upload a file with an allowed extension (such as .png) that contains HTML and JavaScript. The script runs in the site's origin when an agent, administrator or other user opens the attachment. The drag-and-drop uploader must be enabled, and it is off by default.

## References

- https://wpsec.com/vuln/WPSEC-2026-1143/
- https://plugins.svn.wordpress.org/awesome-support/tags/6.4.2/
- https://wordpress.org/plugins/awesome-support/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1143/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.