What’s Vulnerable › Products
awesomesupport Awesome Support – WordPress HelpDesk & Support Plugin vulnerabilities
30 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 13 published in the last 12 months.
Latest awesomesupport Awesome Support – WordPress HelpDesk & Support Plugin vulnerabilities
- CVE-2026-103370 — Awesome Support <= 6.4.1 - Authenticated (Custom+) Stored Cross-Site Scripting via Ticket Attachment MIME Confusion (CVSS 6.4)
- CVE-2026-96268 — Awesome Support <= 6.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'gdpr-data' Parameter via wpas_gdpr_user_opt_out AJAX Action (CVSS 6.4)
- CVE-2026-96820 — WordPress Awesome Support plugin <= 6.3.9 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- CVE-2026-19946 — Awesome Support <= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Denial via 'user_id' Parameter (CVSS 4.3)
- CVE-2026-4654 — Awesome Support <= 6.3.7 - Authenticated (Subscriber+) Insecure Direct Object Reference to Unauthorized Ticket Reply Access via 'ticket_id' Parameter (CVSS 5.3)
- CVE-2025-12641 — Awesome Support – WordPress HelpDesk & Support Plugin <= 6.3.6 - Missing Authorization to Unauthenticated Role Demotion (CVSS 6.5)
- CVE-2025-58662 — WordPress Awesome Support plugin <= 6.3.5 - Deserialization of untrusted data vulnerability (CVSS 7.2)
- CVE-2025-53340 — WordPress Awesome Support plugin <= 6.3.6 - Sensitive Data Exposure vulnerability (CVSS 5.3)
- CVE-2024-13567 — Awesome Support – WordPress HelpDesk & Support Plugin <= 6.3.1 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory (CVSS 7.5)
- CVE-2024-54289 — WordPress Awesome Support plugin <= 6.3.1 - Broken Access Control vulnerability (CVSS 6.5)
- CVE-2023-49857 — WordPress Awesome Support plugin <= 6.1.7 - Broken Access Control vulnerability (CVSS 6.5)
- CVE-2023-49757 — WordPress Awesome Support plugin <= 6.1.10 - Broken Access Control + CSRF vulnerability (CVSS 5.4)
- CVE-2023-48324 — WordPress Awesome Support HelpDesk plugin <= 6.1.4 - Broken Access control vulnerability (CVSS 5.4)
- CVE-2024-35741 — WordPress Awesome Support plugin <= 6.1.7 - Broken Access Control vulnerability (CVSS 8.8)
- CVE-2024-24716 — WordPress Awesome Support plugin <= 6.1.6 - Broken Access Control vulnerability (CVSS 5.4)
- CVE-2024-30539 — WordPress Awesome Support plugin <= 6.1.7 - Broken Access Control vulnerability (CVSS 9.8)
- CVE-2024-0596 — Awesome Support – WordPress HelpDesk & Support Plugin <= 6.1.7 - Missing Authorization via editor_html() (CVSS 5.3)
- CVE-2024-0595 — Awesome Support – WordPress HelpDesk & Support Plugin <= 6.1.7 - Missing Authorization via wpas_get_users() (CVSS 4.3)
- CVE-2024-0594 — Awesome Support – WordPress HelpDesk & Support Plugin <= 6.1.7 - Authenticated (Subscriber+) SQL Injection (CVSS 8.8)
- CVE-2023-51538 — WordPress Awesome Support Plugin <= 6.1.5 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 8.8)
- CVE-2023-48323 — WordPress Awesome Support Plugin <= 6.1.4 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 8.8)
- CVE-2023-5355 — Awesome Support < 6.1.5 - Submitter+ Arbitrary File Deletion (CVSS 8.1)
- CVE-2023-5354 — Awesome Support < 6.1.5 - Reflected Cross-Site Scripting (CVSS 6.1)
- CVE-2023-5352 — Awesome Support < 6.1.5 - Insufficient permission check in wpas_edit_reply (CVSS 4.3)
- CVE-2022-3511 — Awesome Support < 6.1.2 - Subscriber+ Arbitrary Exported Tickets Download (CVSS 6.5)