CVE-2026-11589 is a stored cross-site scripting (XSS) vulnerability in the WP Support Plus Responsive Ticket System WordPress plugin through version 9.1.2. The plugin fails to properly validate uploaded files, enabling unauthenticated attackers to upload files containing malicious JavaScript payloads. These files are stored in locations accessible by other users, leading to stored XSS attacks that can affect site users and administrators. No CVSS score or official remediation details are currently available.

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of the vulnerable website for any user who accesses the malicious file. This can lead to session hijacking, defacement, or other malicious actions targeting site users and administrators. The vulnerability affects the confidentiality and integrity of user interactions with the affected site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting file upload permissions, disabling file uploads if possible, or implementing additional server-side validation and filtering to block potentially malicious file types such as HTML or SVG.