WordPress plugin
WP Support Plus Responsive Ticket System security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical4
- High7
- Medium4
- Low0
All WP Support Plus Responsive Ticket System vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium5.3 | Insecure Direct Object Reference to Unauthenticated Support Ticket Access ≤9.1.2No patch available | CVE-2026-11875 | |
| High7.5 | Unauthenticated SQL Injection ≤9.1.2No patch available | CVE-2026-11590 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤9.1.2No patch available | CVE-2026-11589 | |
| High7.2 | Stored Cross-Site Scripting <9.1.2Update to 9.1.2 | CVE-2019-15331 | |
| Medium6.1 | Stored Cross-Site Scripting <9.1.2Update to 9.1.2 | CVE-2019-7299 | |
| Critical9.8 | SQL Injection ≤9.0.2Update to 9.0.3 | CVE-2018-1000131 | |
| High8.8 | Arbitrary File Upload <8.0.8Update to 8.0.8 | — | |
| High8.8 | SQL Injection ≤7.1.4Update to 8.0.0 | — | |
| High7.5 | Insecure Direct Object Reference <7.1.0Update to 7.1.0 | CVE-2016-10930 | |
| Critical9.8 | Authentication Bypass <8.0.0Update to 8.0.0 | — | |
| Critical9.8 | Improper Authentication ≤4.1Update to 4.2 | CVE-2014-10389 | |
| High7.5 | Directory Traversal <4.2Update to 4.2 | CVE-2014-10390 | |
| Medium6.1 | JavaScript Injection ≤4.0Update to 4.1 | CVE-2014-10391 | |
| Medium5.3 | Full Path Disclosure <4.2Update to 4.2 | CVE-2014-10388 | |
| Critical9.8 | SQL Injection <4.2Update to 4.2 | CVE-2014-10387 |
- Medium5.3Insecure Direct Object Reference to Unauthenticated Support Ticket Access
≤9.1.2No patch available
- High7.5Unauthenticated SQL Injection
≤9.1.2No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
≤9.1.2No patch available
- High7.2Stored Cross-Site Scripting
<9.1.2Update to 9.1.2
- Medium6.1Stored Cross-Site Scripting
<9.1.2Update to 9.1.2
- Critical9.8SQL Injection
≤9.0.2Update to 9.0.3
- High8.8Arbitrary File Upload
<8.0.8Update to 8.0.8
- High8.8SQL Injection
≤7.1.4Update to 8.0.0
- High7.5Insecure Direct Object Reference
<7.1.0Update to 7.1.0
- Critical9.8Authentication Bypass
<8.0.0Update to 8.0.0
- Critical9.8Improper Authentication
≤4.1Update to 4.2
- High7.5Directory Traversal
<4.2Update to 4.2
- Medium6.1JavaScript Injection
≤4.0Update to 4.1
- Medium5.3Full Path Disclosure
<4.2Update to 4.2
- Critical9.8SQL Injection
<4.2Update to 4.2
WP Support Plus Responsive Ticket System: common questions
Does WP Support Plus Responsive Ticket System have known vulnerabilities?
Yes. VulnCrest Radar lists 15 known vulnerabilities in WP Support Plus Responsive Ticket System: 4 critical, 7 high, 4 medium. At least one is not fixed in the latest version.
How do I check which version of WP Support Plus Responsive Ticket System I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent WP Support Plus Responsive Ticket System vulnerability?
CVE-2026-11875, published Jun 18, 2026: Support Plus Responsive Ticket System <= 9.1.2 - Insecure Direct Object Reference to Unauthenticated Support Ticket Access. Severity: Medium (CVSS 5.3).
Is any WP Support Plus Responsive Ticket System vulnerability listed in CISA KEV?
No. None of the known WP Support Plus Responsive Ticket System vulnerabilities is currently listed in the CISA KEV catalog.