CVE-2026-11589 is a stored XSS vulnerability in the WP Support Plus Responsive Ticket System WordPress plugin versions up to and including 9.1.2. The plugin does not properly validate uploaded files, enabling unauthenticated attackers to upload files with embedded malicious JavaScript (e.g., HTML or SVG). These files are stored in locations accessible to site users and administrators, which can lead to execution of arbitrary scripts in their browsers, compromising confidentiality, integrity, and availability.

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of the affected site. This can lead to theft of sensitive information, session hijacking, and full compromise of user accounts including administrative users. The vulnerability affects site confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict file upload permissions and monitor for suspicious uploads. Consider disabling file uploads in the plugin if not required. Follow vendor updates closely for an official patch or temporary mitigation.