High severity8.8NVD Advisory· Published Jun 30, 2026· Updated Jun 30, 2026

CVE-2026-11589

Description

The WP Support Plus Responsive Ticket System WordPress plugin through 9.1.2 does not properly validate uploaded files, allowing unauthenticated users to upload files containing malicious JavaScript (such as HTML or SVG) to a publicly accessible location, leading to Stored Cross-Site Scripting attacks against site users and administrators.

Affected products

WordPress/Wp Support Plus Responsive Ticket Systemllm-fuzzy
Range: <=9.1.2
Package: https://wordpress.org/plugins/wp-support-plus-responsive-ticket-system

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/c46479c2-4eef-485f-ae98-1f487efa4263/nvd

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000