Awesome Support CVE-2026-96820

Exploitation targets the Awesome Support WordPress plugin at versions 6.3.9 and earlier and requires victim user interaction (UI:R) - an administrator or support agent must view attacker-controlled content for the injected script to execute. The description indicates a subscriber-level (authenticated low-privilege) actor may be needed to inject the payload, which conflicts with the CVSS PR:N and should be verified; if a subscriber account is required, exploitation is limited to sites that allow user registration. The scope change (S:C) reflects that the payload executes in the victim's browser/session context rather than the plugin's own. Limiting factors: required user interaction, likely dependence on an authenticated (subscriber) account, and confinement to sites running the vulnerable plugin version.

This is a stored/reflected Cross-Site Scripting flaw (CWE-79) in the Awesome Support WordPress plugin at versions <= 6.3.9, reported by Patchstack and scored CVSS 3.1 7.1 (HIGH) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. There is a notable internal conflict in the source data: the description explicitly says 'Subscriber Cross Site Scripting,' which implies an authenticated low-privilege actor (subscriber role) is required to inject the payload, yet the CVSS vector encodes PR:N (no privileges). Per the precision rules, auth level is taken from the vector, so it is scored as unauthenticated, but defenders should treat the actual privilege requirement as unresolved - verify with Patchstack/vendor whether a subscriber account is a hard prerequisite. There is no EPSS score, no CISA KEV listing, and no public proof-of-concept provided, so this is best characterized as no public exploit identified at time of analysis. The scope-change (S:C) reflects script execution crossing into a victim's browser context, but impacts are only Low across C/I/A, and exploitation requires user interaction (UI:R). Net assessment: a real but moderate-priority issue - a high-ish CVSS driven largely by scope change and network vector, not by severe technical impact or evidence of active exploitation. The primary defensive value is patching to a fixed release and role hygiene rather than emergency response.

An attacker (per the vector, unauthenticated; per the description, possibly a low-privilege subscriber) crafts a malicious link or support-ticket input containing a JavaScript payload targeting the Awesome Support plugin. When an administrator or agent views the injected content, the script executes in their authenticated browser session, potentially stealing session cookies or performing actions in the WordPress admin context. No public PoC is available at time of analysis, and successful exploitation depends on victim interaction (UI:R).