Skip to content
Noroxi

Awesome Support

awesome-support · plugin

Known security vulnerabilities for Awesome Support. Find out in seconds which version runs on your site with WP Lens.

25 known vulnerabilities

1 critical · latest Oct 1, 2026

Vulnerabilities

  • CVE-2024-30539

    WordPress Awesome Support plugin <= 6.1.7 - Broken Access Control vulnerability

    Critical 9.8

  • CVE-2024-35741

    WordPress Awesome Support plugin <= 6.1.7 - Broken Access Control vulnerability

    High 8.8

  • CVE-2024-0594

    Awesome Support – WordPress HelpDesk & Support Plugin <= 6.1.7 - Authenticated (Subscriber+) SQL Injection

    High 8.8

  • CVE-2023-51538

    WordPress Awesome Support Plugin <= 6.1.5 is vulnerable to Cross Site Request Forgery (CSRF)

    High 8.8

  • CVE-2023-48323

    WordPress Awesome Support Plugin <= 6.1.4 is vulnerable to Cross Site Request Forgery (CSRF)

    High 8.8

  • CVE-2024-13567

    Awesome Support – WordPress HelpDesk & Support Plugin <= 6.3.1 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory

    High 7.5

  • CVE-2015-9318

    The awesome-support plugin before 3.1.7 for WordPress has a security issue in which shortcodes are allowed in replies.

    High 7.5

  • CVE-2023-51537

    WordPress Awesome Support plugin <= 6.1.5 - Broken Access Control vulnerability

    High 7.3

  • CVE-2025-58662

    WordPress Awesome Support plugin <= 6.3.5 - Deserialization of untrusted data vulnerability

    High 7.2

  • CVE-2026-96820

    WordPress Awesome Support plugin <= 6.3.9 - Cross Site Scripting (XSS) vulnerability

    High 7.1

  • CVE-2025-12641

    Awesome Support – WordPress HelpDesk & Support Plugin <= 6.3.6 - Missing Authorization to Unauthenticated Role Demotion

    Medium 6.5

  • CVE-2024-54289

    WordPress Awesome Support plugin <= 6.3.1 - Broken Access Control vulnerability

    Medium 6.5

  • CVE-2023-49857

    WordPress Awesome Support plugin <= 6.1.7 - Broken Access Control vulnerability

    Medium 6.5

  • CVE-2026-96268

    Awesome Support <= 6.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'gdpr-data' Parameter via wpas_gdpr_user_opt_out AJAX Action

    Medium 6.4

  • CVE-2015-9317

    The awesome-support plugin before 3.1.7 for WordPress has XSS via custom information messages.

    Medium 6.1

  • CVE-2023-49757

    WordPress Awesome Support plugin <= 6.1.10 - Broken Access Control + CSRF vulnerability

    Medium 5.4

  • CVE-2023-48324

    WordPress Awesome Support HelpDesk plugin <= 6.1.4 - Broken Access control vulnerability

    Medium 5.4

  • CVE-2024-24716

    WordPress Awesome Support plugin <= 6.1.6 - Broken Access Control vulnerability

    Medium 5.4

  • CVE-2022-38073

    WordPress Awesome Support plugin <= 6.0.7 - Multiple Authenticated Persistent XSS (Additional Interested Parties)

    Medium 5.4

  • CVE-2021-36919

    WordPress Awesome Support plugin <= 6.0.6 - Multiple Authenticated Reflected Cross-Site Scripting (XSS) vulnerabilities

    Medium 5.4

  • CVE-2026-4654

    Awesome Support <= 6.3.7 - Authenticated (Subscriber+) Insecure Direct Object Reference to Unauthorized Ticket Reply Access via 'ticket_id' Parameter

    Medium 5.3

  • CVE-2025-53340

    WordPress Awesome Support plugin <= 6.3.6 - Sensitive Data Exposure vulnerability

    Medium 5.3

  • CVE-2024-0596

    Awesome Support – WordPress HelpDesk & Support Plugin <= 6.1.7 - Missing Authorization via editor_html()

    Medium 5.3

  • CVE-2026-19946

    Awesome Support <= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Denial via 'user_id' Parameter

    Medium 4.3

  • CVE-2024-0595

    Awesome Support – WordPress HelpDesk & Support Plugin <= 6.1.7 - Missing Authorization via wpas_get_users()

    Medium 4.3

← Back to directory