WordPress plugin
Awesome Support – WordPress HelpDesk & Support Plugin security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical0
- High5
- Medium26
- Low0
All Awesome Support – WordPress HelpDesk & Support Plugin vulnerabilities
- Medium6.4Authenticated (Custom+) Stored Cross-Site Scripting via Ticket Attachment MIME Confusion
≤6.4.1Update to 6.4.2
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'gdpr-data' Parameter via wpas_gdpr_user_opt_out AJAX Action
≤6.4.0Update to 6.4.1
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
≤6.3.9Update to 6.4.0
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary User Denial via 'user_id' Parameter
≤6.3.9Update to 6.4.0
- Medium5.3Authenticated (Subscriber+) Insecure Direct Object Reference to Unauthorized Ticket Reply Access via 'ticket_id' Parameter
≤6.3.7Update to 6.3.8
- Medium6.5Missing Authorization to Unauthenticated Role Demotion
≤6.3.6Update to 6.3.7
- High7.5Authenticated (Support Manager+) PHP Object Injection
≤6.3.5Update to 6.3.6
- Medium5.3Information Exposure
≤6.3.6Update to 6.3.7
- High7.5Unauthenticated Sensitive Information Exposure Through Unprotected Directory
≤6.3.1Update to 6.3.2
- Medium4.3Missing Authorization
≤6.3.1Update to 6.3.2
- Medium5.3Missing Authorization
≤6.1.7Update to 6.1.8
- Medium4.3Insufficient Authorization via wpas_can_delete_attachments()
≤6.1.6Update to 6.1.7
- High8.8Authenticated (Subscriber+) SQL Injection
≤6.1.7Update to 6.1.8
- Medium4.3Missing Authorization via wpas_get_users()
≤6.1.7Update to 6.1.8
- Medium5.3Missing Authorization via editor_html()
≤6.1.7Update to 6.1.8
- Medium4.3Cross-Site Request Forgery
≤6.1.5Update to 6.1.6
- Medium5.3Missing Authorization via wpas_load_reply_history
≤6.1.5Update to 6.1.6
- Medium5.3Missing Authorization
≤6.1.7Update to 6.1.8
- Medium5.4Missing Authorization
≤6.1.10Update to 6.1.11
- Medium4.3Missing Authorization via wpas_edit_reply_ajax()
≤6.1.4Update to 6.1.5
- Medium4.3Cross-Site Request Forgery via wpas_edit_reply_ajax()
≤6.1.4Update to 6.1.5
- Medium6.1Reflected Cross-Site Scripting
≤6.1.4Update to 6.1.5
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification
≤6.1.4Update to 6.1.5
- High8.1Authenticated (Submitter+) Arbitrary File Deletion
≤6.1.4Update to 6.1.5
- Medium4.3Insecure Direct Object Reference to (Subscriber+) Ticket Export
≤6.1.1Update to 6.1.2
- High7.2Authenticated Stored Cross-Site Scripting
≤6.0.7Update to 6.0.8
- Medium6.1Reflected Cross-Site Scripting
≤6.0.6Update to 6.0.7
- Medium6.1Reflected Cross-Site Scripting
all versionsNo patch available
- Medium4.8Cross-Site Scripting via post_title
≤6.0.13Update to 6.0.14
- Medium6.5Arbitrary Shortcode Execution
<3.1.7Update to 3.1.7
- Medium6.1Cross-Site Scripting
<3.1.7Update to 3.1.7
Awesome Support – WordPress HelpDesk & Support Plugin: common questions
Does Awesome Support – WordPress HelpDesk & Support Plugin have known vulnerabilities?
Yes. VulnCrest Radar lists 31 known vulnerabilities in Awesome Support – WordPress HelpDesk & Support Plugin: 5 high, 26 medium. At least one is not fixed in the latest version.
How do I check which version of Awesome Support – WordPress HelpDesk & Support Plugin I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Awesome Support – WordPress HelpDesk & Support Plugin vulnerability?
CVE-2026-103370, published Oct 27, 2026: Awesome Support <= 6.4.1 - Authenticated (Custom+) Stored Cross-Site Scripting via Ticket Attachment MIME Confusion. Severity: Medium (CVSS 6.4).
Is any Awesome Support – WordPress HelpDesk & Support Plugin vulnerability listed in CISA KEV?
No. None of the known Awesome Support – WordPress HelpDesk & Support Plugin vulnerabilities is currently listed in the CISA KEV catalog.