WP Support Plus CVE-2026-11589

Exploitation requires that the WP Support Plus Responsive Ticket System plugin (≤9.1.2) be installed and that its file-upload/attachment feature be reachable by unauthenticated users - the default ticket-submission path. The attacker needs no account (PR:N), but the payload only triggers when a victim - typically a site user or administrator - views or opens the uploaded HTML/SVG file (UI:R is the key limiting factor): the XSS is stored but not self-executing. Limiting factors are therefore the required victim interaction with the malicious attachment and the presence of the plugin with public uploads enabled; there is no platform-specific constraint since it executes in the browser.

Signals are mixed-to-moderate. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) indicates remote, low-complexity, unauthenticated exploitation but requires user interaction. The C:H/I:H/A:H impact metrics appear overstated for a stored-XSS issue - classic XSS impact is typically Low confidentiality/integrity with no availability impact and a scope change - so the 8.8 likely inflates real-world severity; verify against the WPScan advisory. Public exploit code exists, which raises practical risk, but the vulnerability is NOT in CISA KEV (no confirmed active exploitation) and no EPSS probability was provided, so widespread automated exploitation cannot be asserted. The realistic risk is admin-session/credential compromise via a payload that fires when a privileged user opens the malicious attachment - meaningful but gated by the UI:R requirement. Net: a credible priority for sites running this plugin given the public POC and unauthenticated upload, but not a drop-everything emergency absent KEV/EPSS escalation signals.

An unauthenticated attacker submits a support ticket with an attached SVG or HTML file containing embedded JavaScript, which the plugin stores at a publicly accessible URL without sanitization. When a support agent or administrator opens the attachment (or the URL is shared/clicked), the script executes in their authenticated session, enabling session/cookie theft or actions performed as that privileged user. Public exploit code for this flaw is available, lowering the barrier to a working attack.