What is the CVSS score of CVE-2026-11589?

CVE-2026-11589 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of WP Support Plus are affected by CVE-2026-11589?

The WP Support Plus Responsive Ticket System plugin (versions ≤9.1.2) contains a stored cross-site scripting vulnerability allowing unauthenticated attackers to upload and execute malicious…

Is there a public PoC exploit available for CVE-2026-11589?

Yes, a public proof-of-concept exploit is available for CVE-2026-11589. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-11589?

Within 24 hours: Disable or uninstall WP Support Plus Responsive Ticket System; if operationally critical, restrict web server access to the plugin's upload directory to authenticated users only (via .htaccess, Nginx, or WAF rules). Within 7 days: Monitor the plugin repository and WPScan for patch release (target version 9.1.3+); audit wp-content/uploads/ for suspicious .html, .svg, or .js files and remove any malicious uploads. Within 30 days: Migrate to an alternative support ticket system with verified security (e.g., Gravity Forms Pro, Trac, Formidable Forms); deploy site-wide Content Security Policy headers with script-src: 'self' to block XSS execution.

WP Support Plus CVE-2026-11589

EUVD-2026-40262 HIGH

2026-06-30 WPScan

GHSA-w4vj-qmqh-q69w

WordPress XSS Wp Support Plus Responsive Ticket System Unknown

8.8

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

6.1 MEDIUM

Unauthenticated remote upload but payload needs a victim to open it (UI:R); stored XSS executes in another security context (S:C) with limited confidentiality/integrity impact and no availability impact, unlike the inflated vendor C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 30, 2026 - 13:24 vuln.today

CVSS changed

Jun 30, 2026 - 13:22 NVD

8.8 (HIGH)

CVE Published

Jun 30, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 06:00 cve.org

HIGH 8.8

DescriptionCVE.org

The WP Support Plus Responsive Ticket System WordPress plugin through 9.1.2 does not properly validate uploaded files, allowing unauthenticated users to upload files containing malicious JavaScript (such as HTML or SVG) to a publicly accessible location, leading to Stored Cross-Site Scripting attacks against site users and administrators.

Articles & Coverage 1

News 7 New WordPress Vulnerabilities - 2 Critical, 5 High, 2 With POC Jul 01, 2026

AnalysisAI

Stored cross-site scripting in the WP Support Plus Responsive Ticket System WordPress plugin (all versions through 9.1.2) lets unauthenticated attackers upload files containing malicious JavaScript - such as HTML or SVG payloads - to a publicly accessible location, where the script executes in the browsers of site users and administrators who view it. The flaw stems from missing validation of uploaded file types/content. Publicly available exploit code exists (reported by WPScan), though it is not listed in CISA KEV and no EPSS score was provided.

Technical ContextAI

WP Support Plus Responsive Ticket System is a helpdesk/support-ticket plugin for WordPress that exposes ticket-creation and attachment-upload functionality to site visitors. The root cause is improper validation of uploaded files (CWE-434, Unrestricted Upload of File with Dangerous Type), which in turn enables the stored XSS (CWE-79). Because the plugin accepts attacker-controlled HTML or SVG files and stores them in a web-reachable directory, the browser renders the embedded JavaScript when the file is accessed - turning a file-upload weakness into persistent script injection. The official CWE field was supplied as N/A in the source data, so these classifications are inferred from the description. The affected component is identified by CPE cpe:2.3:a:unknown:wp_support_plus_responsive_ticket_system, with the vendor recorded as 'unknown'.

RemediationAI

No vendor-released patch version was identified at time of analysis - no fixed release (e.g. a version above 9.1.2) appears in the provided data, so a confirmed upgrade target cannot be cited. As specific compensating controls: disable or remove the WP Support Plus Responsive Ticket System plugin if support-ticket attachments are not essential (trade-off: loss of helpdesk functionality); if it must remain, restrict or disable unauthenticated/public ticket attachment uploads and gate ticket submission behind authentication (trade-off: blocks anonymous support requests); enforce server-side allowlisting of attachment types to images-only and store uploads outside the web root or behind a download handler that forces Content-Disposition: attachment and a non-renderable Content-Type (trade-off: breaks inline preview of attachments); and add a Content-Security-Policy that disallows inline script execution to blunt payload firing. Consult the WPScan advisory (https://wpscan.com/vulnerability/c46479c2-4eef-485f-ae98-1f487efa4263/) for the authoritative fix guidance and monitor for an updated plugin release.