# CVE-2026-103370: Awesome Support stored cross-site scripting in file upload

Source: https://junglewise.ai/threats/cve-2026-103370-the-awesome-support-wordpress-helpdesk-support-plugin-plugin-for  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-28. Updated: 2026-10-28  
License: CC BY 4.0 with a link back

CVE-2026-103370 · Severity: medium · CVSS 6.4 · Published 2026-10-28

Awesome Support is a WordPress help desk plugin used to manage customer support tickets. The plugin allows authenticated users with sufficient permissions to inject malicious scripts that execute when other users view the affected pages, potentially compromising account credentials or redirecting users to malicious sites. This vulnerability only affects installations where drag-and-drop file uploads are explicitly enabled.

Technologies: [Awesome Support](https://junglewise.ai/threats/technologies/awesome-support). Vendors: [Awesome Support](https://junglewise.ai/threats/vendors/awesome-support).

## Quick answers

**Is CVE-2026-103370 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-103370 being exploited in the wild.

**How severe is CVE-2026-103370?** Medium severity, with a CVSS score of 6.4, published 28 October 2026.

**Which products and versions are affected?** Awesome Support up to and including 6.4.1.

**Is there a fix for CVE-2026-103370?** No fixed version is recorded yet. Disable the "Enable drag-n-drop uploader for ticket form" setting if file uploads are not required, or upgrade to a patched version when available. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-103370 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-103370?** Check whether you run Awesome Support at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Disable the "Enable drag-n-drop uploader for ticket form" setting if file uploads are not required, or upgrade to a patched version when available.

## Technical details

A stored cross-site scripting (XSS) vulnerability exists in the wpas_files parameter of the file uploader component due to insufficient input sanitization and output escaping. Authenticated attackers with custom-level access or higher can inject arbitrary JavaScript that persists in the database. The vulnerability requires the "Enable drag-n-drop uploader for ticket form" setting to be enabled, which is disabled by default.

## Affected products

- Awesome Support Awesome Support up to and including 6.4.1

## Timeline

- 2026-10-28: disclosed

## References

- [https://plugins.trac.wordpress.org/browser/awesome-support/tags/6.4.1/includes/file-uploader/class-file-uploader.php](https://plugins.trac.wordpress.org/browser/awesome-support/tags/6.4.1/includes/file-uploader/class-file-uploader.php)
- [https://plugins.trac.wordpress.org/browser/awesome-support/tags/6.4.1/includes/file-uploader/class-file-uploader.php](https://plugins.trac.wordpress.org/browser/awesome-support/tags/6.4.1/includes/file-uploader/class-file-uploader.php)

## Related threats

- [Awesome Support WordPress HelpDesk plugin stored XSS in GDPR data parameter](https://junglewise.ai/threats/cve-2026-96268-the-awesome-support-wordpress-helpdesk-support-plugin-plugin-for)
- [Awesome Support Cross Site Scripting](https://junglewise.ai/threats/cve-2026-96820-subscriber-cross-site-scripting-xss-in-awesome-support-6-3-9)
- [Awesome Support missing authorization in user moderation](https://junglewise.ai/threats/cve-2026-19946-awesome-support-missing-authorization-in-user-moderation)
- [Awesome Support WordPress Plugin IDOR in wpas_get_ticket_replies_ajax](https://junglewise.ai/threats/cve-2026-4654-awesome-support-wordpress-plugin-idor-in-wpas-get-ticket-replies)