Awesome Support CVE-2026-96268

Requires an authenticated WordPress account with Subscriber-level access or higher on a site running Awesome Support ≤6.4.0 with the GDPR integration feature active. The attacker needs the wpas-gdpr-nonce, which is automatically emitted to every logged-in user on frontend plugin pages and on /wp-admin/profile.php - so no special privilege is needed to obtain it. Cross-account targeting is possible because the AJAX handlers accept an arbitrary 'gdpr-user' ID without verifying it belongs to the requester. Primary limiting factor: the site must allow the attacker to obtain a Subscriber account (open/self-registration lowers this substantially); impact is realized only when a victim subsequently views the injected page.

This is a moderate, authenticated-only web vulnerability that does not warrant emergency prioritization. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, 6.4 Medium) shows network-reachable, low-complexity exploitation but requires authentication at Subscriber level (PR:L) - a low bar on sites with open registration, but still a bar. The scope change (S:C) and C:L/I:L reflect classic stored-XSS impact: script executes in another user's browser context rather than directly compromising the server. No EPSS score, no CISA KEV listing, and no public exploit code are present in the provided data, so exploitation status is: no public exploit identified at time of analysis. The notable amplifier beyond a typical self-XSS is the access-control defect: the AJAX handlers accept an arbitrary 'gdpr-user' ID without ownership verification (an IDOR condition) and the gating 'wpas-gdpr-nonce' is emitted to every logged-in user via wp_localize_script, so a Subscriber can target OTHER accounts rather than only themselves - this elevates it from a nuisance to a genuine cross-account stored XSS. No data is missing or internally conflicting; the vendor vector and the description are consistent. Net: a real but low-urgency issue, patch in a normal maintenance cycle unless the site allows untrusted user registration, in which case prioritize higher.

On an Awesome Support site that permits self-registration, an attacker registers a Subscriber account, reads the wpas-gdpr-nonce handed to every logged-in user, and submits a GDPR AJAX request specifying a victim's user ID with a malicious payload in the 'gdpr-data' parameter. The payload is stored and later executes in the victim's (or an admin's) browser when they view the injected page, enabling session actions in their context. No public proof-of-concept is referenced in the available data.