Awesome Support CVE-2026-103370

Exploitation requires three concrete conditions, all drawn from the description: (1) the 'Enable drag-n-drop uploader for ticket form' setting must be turned on, which is disabled by default, so standard installations are not affected; (2) the attacker must hold an authenticated account with custom-level access or above (PR:L), not an anonymous visitor; and (3) the payload is delivered through the 'wpas_files' parameter and only fires when another user subsequently loads the page containing the injected, insufficiently escaped content. The default-disabled uploader setting and the authenticated low-privilege requirement are the primary factors limiting realistic exploitation despite the network-facing AV:N vector.

This is a medium-severity stored XSS (CVSS 6.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) whose real-world risk is meaningfully constrained by its preconditions rather than its network-reachable vector. The CVSS vector is network-exploitable at low complexity with no user interaction to trigger storage, and the scope change (S:C) correctly reflects that the injected script executes in the browser context of other users who view the page. However, PR:L requires the attacker to already hold a 'custom-level access and above' authenticated account, and the description explicitly limits exploitation to deployments where the non-default 'Enable drag-n-drop uploader for ticket form' setting has been turned on - so the AV:N/AC:L framing understates the practical barriers. No EPSS score, no CISA KEV listing, and no confirmed public exploit code were supplied; the vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a patch-on-normal-cycle priority rather than an active-exploitation fire drill. There is no conflict between signals: all point to a genuine but non-urgent, config-and-privilege-gated issue. Treat it as a real priority for sites running Awesome Support with the drag-n-drop uploader enabled and untrusted lower-privileged users, and lower priority elsewhere.

On a site where the 'Enable drag-n-drop uploader for ticket form' setting is enabled, an authenticated user holding custom-level (or higher) access injects a malicious script payload through the 'wpas_files' parameter when submitting or editing a ticket. The payload is stored without adequate sanitization and executes in the browser of any user - such as a support agent or administrator - who subsequently views the affected page. No public exploit identified at time of analysis.