CVE-2026-96268

The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gdpr-data' parameter in all versions up to, and including, 6.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by Subscriber-level users against other accounts because the AJAX handlers accept an arbitrary gdpr-user ID without verifying it belongs to the requester, and the required wpas-gdpr-nonce is emitted via wp_localize_script to every logged-in user on frontend plugin pages and on /wp-admin/profile.php.

• CWE-79

• https://plugins.trac.wordpress.org/browser/awesome-support/tags/6.4.0/includes/functions-general.php#L2190
• https://plugins.trac.wordpress.org/browser/awesome-support/tags/6.4.0/includes/functions-user.php#L1538
• https://plugins.trac.wordpress.org/browser/awesome-support/tags/6.4.0/includes/gdpr-integration/gdpr-privacy-options.php#L1111
• https://plugins.trac.wordpress.org/browser/awesome-support/tags/6.4.0/includes/gdpr-integration/gdpr-privacy-options.php#L1186
• https://plugins.trac.wordpress.org/browser/awesome-support/tags/6.4.0/includes/gdpr-integration/gdpr-user-profile.php#L250
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3719753%40awesome-support&new=3719753%40awesome-support
• https://www.wordfence.com/threat-intel/vulnerabilities/id/617afd4e-107a-48ad-9e3e-1771874796ff?source=cve

Published

Oct 1, 2026

Last Modified

Oct 1, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-96262IBM Power Systems Firmware FW1060.00 through FW1060.81 is af…8.2
• CVE-2026-96263IBM Power Systems Firmware FW1120.00 through FW1120.01, FW11…8.2
• CVE-2026-96264IBM Power Systems Firmware FW1060.00 through FW1060.81 is a…8.2
• CVE-2026-96265IBM Power Systems Firmware FW1060.00 through FW1060.81 is af…8.2
• CVE-2026-96266IBM Power Systems Firmware FW1060.00 through FW1060.81 is af…8.2
• CVE-2026-96267The WP Visitor Statistics (Real Time Traffic) plugin for Wor…7.5
• CVE-2026-96269GNU Emacs 28.1 through 31.1 allows arbitrary code execution …7.5
• CVE-2026-9627A security flaw has been discovered in UTT HiPER 1200GW up t…8.8
• CVE-2026-96270The Ultimate Member – User Profile, Registration, Login, Mem…7.2
• CVE-2026-96271Photoview through 2.4.0 contains an authorization bypass vul…7.1
• CVE-2026-96272ClipBucket v5 before 5.5.3-#182 contains a blind SQL injecti…7.5
• CVE-2026-96273Ghidra before 12.1.4 fails to validate the TYPE_COL byte in …5.5