# CVE-2026-96820: Awesome Support Cross Site Scripting

Source: https://junglewise.ai/threats/cve-2026-96820-subscriber-cross-site-scripting-xss-in-awesome-support-6-3-9  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-30. Updated: 2026-09-30  
License: CC BY 4.0 with a link back

CVE-2026-96820 · Severity: high · CVSS 7.1 · Published 2026-09-30

Awesome Support is a WordPress plugin that provides customer support ticketing functionality. A cross-site scripting vulnerability in versions 6.3.9 and earlier allows attackers with subscriber-level access to inject malicious scripts that could steal visitor data or hijack user accounts. Exploitation requires user interaction, such as tricking a privileged user into clicking a malicious link.

Technologies: [Awesome Support](https://junglewise.ai/threats/technologies/awesome-support). Vendors: [Awesome Support](https://junglewise.ai/threats/vendors/awesome-support).

## Quick answers

**Is CVE-2026-96820 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-96820 being exploited in the wild.

**How severe is CVE-2026-96820?** High severity, with a CVSS score of 7.1, published 30 September 2026.

**Which products and versions are affected?** Awesome Support <= 6.3.9.

**Is there a fix for CVE-2026-96820?** A patch was published on 2026-09-28: Fixed in version 6.4.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-96820 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-96820?** Check whether you run Awesome Support at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The plugin fails to properly sanitize user input, allowing authenticated subscribers to inject arbitrary JavaScript code. The vulnerability can be triggered through crafted input that a higher-privileged user must interact with to execute. Successful exploitation enables session hijacking, credential theft, or malware distribution to site visitors. A patch is available in version 6.4.0.

## Affected products

- Awesome Support Awesome Support <= 6.3.9

## Timeline

- 2026-09-28: disclosed
- 2026-09-28: patched: Fixed in version 6.4.0

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/awesome-support/vulnerability/wordpress-awesome-support-plugin-6-3-9-cross-site-scripting-xss-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/awesome-support/vulnerability/wordpress-awesome-support-plugin-6-3-9-cross-site-scripting-xss-vulnerability?_s_id=cve)

## Related threats

- [Awesome Support stored cross-site scripting in file upload](https://junglewise.ai/threats/cve-2026-103370-the-awesome-support-wordpress-helpdesk-support-plugin-plugin-for)
- [Awesome Support WordPress HelpDesk plugin stored XSS in GDPR data parameter](https://junglewise.ai/threats/cve-2026-96268-the-awesome-support-wordpress-helpdesk-support-plugin-plugin-for)
- [Awesome Support missing authorization in user moderation](https://junglewise.ai/threats/cve-2026-19946-awesome-support-missing-authorization-in-user-moderation)
- [Awesome Support WordPress Plugin IDOR in wpas_get_ticket_replies_ajax](https://junglewise.ai/threats/cve-2026-4654-awesome-support-wordpress-plugin-idor-in-wpas-get-ticket-replies)