Awesome Support – WordPress HelpDesk & Support Plugin

Vulnerabilities

• CVE-2024-30539unauthenticated≤ 6.1.7

  WordPress Awesome Support plugin <= 6.1.7 - Broken Access Control vulnerability

  Critical 9.8

• CVE-2023-51538unauthenticated · needs a click≤ 6.1.5

  WordPress Awesome Support Plugin <= 6.1.5 is vulnerable to Cross Site Request Forgery (CSRF)

  High 8.8

• CVE-2023-48323unauthenticated · needs a click≤ 6.1.4

  WordPress Awesome Support Plugin <= 6.1.4 is vulnerable to Cross Site Request Forgery (CSRF)

  High 8.8

• CVE-2024-35741login required≤ 6.1.7

  WordPress Awesome Support plugin <= 6.1.7 - Broken Access Control vulnerability

  High 8.8

• CVE-2024-0594subscriber+≤ 6.1.7

  Awesome Support – WordPress HelpDesk & Support Plugin <= 6.1.7 - Authenticated (Subscriber+) SQL Injection

  High 8.8

• CVE-2024-13567unauthenticated≤ 6.3.1

  Awesome Support – WordPress HelpDesk & Support Plugin <= 6.3.1 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory

  High 7.5

• CVE-2015-9318unauthenticated

  The awesome-support plugin before 3.1.7 for WordPress has a security issue in which shortcodes are allowed in replies.

  High 7.5

• CVE-2023-51537unauthenticated≤ 6.1.5

  WordPress Awesome Support plugin <= 6.1.5 - Broken Access Control vulnerability

  High 7.3

• CVE-2025-58662high privilege≤ 6.3.5

  WordPress Awesome Support plugin <= 6.3.5 - Deserialization of untrusted data vulnerability

  High 7.2

• CVE-2026-96820subscriber+≤ 6.3.9

  WordPress Awesome Support plugin <= 6.3.9 - Cross Site Scripting (XSS) vulnerability

  High 7.1

• CVE-2025-12641unauthenticated≤ 6.3.6

  Awesome Support – WordPress HelpDesk & Support Plugin <= 6.3.6 - Missing Authorization to Unauthenticated Role Demotion

  Medium 6.5

• CVE-2023-49857unauthenticated≤ 6.1.7

  WordPress Awesome Support plugin <= 6.1.7 - Broken Access Control vulnerability

  Medium 6.5

• CVE-2024-54289login required≤ 6.3.1

  WordPress Awesome Support plugin <= 6.3.1 - Broken Access Control vulnerability

  Medium 6.5

• CVE-2026-96268subscriber+≤ 6.4.0

  Awesome Support <= 6.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'gdpr-data' Parameter via wpas_gdpr_user_opt_out AJAX Action

  Medium 6.4

• CVE-2015-9317unauthenticated · needs a click

  The awesome-support plugin before 3.1.7 for WordPress has XSS via custom information messages.

  Medium 6.1

• CVE-2021-36919unauthenticated · needs a click≤ 6.0.6

  WordPress Awesome Support plugin <= 6.0.6 - Multiple Authenticated Reflected Cross-Site Scripting (XSS) vulnerabilities

  Medium 5.4

• CVE-2023-49757login required≤ 6.1.10

  WordPress Awesome Support plugin <= 6.1.10 - Broken Access Control + CSRF vulnerability

  Medium 5.4

• CVE-2023-48324login required≤ 6.1.4

  WordPress Awesome Support HelpDesk plugin <= 6.1.4 - Broken Access control vulnerability

  Medium 5.4

• CVE-2024-24716login required≤ 6.1.6

  WordPress Awesome Support plugin <= 6.1.6 - Broken Access Control vulnerability

  Medium 5.4

• CVE-2022-38073login required≤ 6.0.7

  WordPress Awesome Support plugin <= 6.0.7 - Multiple Authenticated Persistent XSS (Additional Interested Parties)

  Medium 5.4

• CVE-2025-53340unauthenticated≤ 6.3.6

  WordPress Awesome Support plugin <= 6.3.6 - Sensitive Data Exposure vulnerability

  Medium 5.3

• CVE-2026-4654subscriber+≤ 6.3.7

  Awesome Support <= 6.3.7 - Authenticated (Subscriber+) Insecure Direct Object Reference to Unauthorized Ticket Reply Access via 'ticket_id' Parameter

  Medium 5.3

• CVE-2024-0596subscriber+≤ 6.1.7

  Awesome Support – WordPress HelpDesk & Support Plugin <= 6.1.7 - Missing Authorization via editor_html()

  Medium 5.3

• CVE-2026-19946subscriber+≤ 6.3.9

  Awesome Support <= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Denial via 'user_id' Parameter

  Medium 4.3

• CVE-2024-0595subscriber+≤ 6.1.7

  Awesome Support – WordPress HelpDesk & Support Plugin <= 6.1.7 - Missing Authorization via wpas_get_users()

  Medium 4.3