CVE-2026-96268 is a stored Cross-Site Scripting vulnerability in the Awesome Support – WordPress HelpDesk & Support Plugin for WordPress, affecting all versions up to and including 6.4.0. The issue arises from insufficient input sanitization and output escaping of the 'gdpr-data' parameter. Authenticated attackers with subscriber-level privileges or above can inject arbitrary JavaScript that executes in the context of other users. The AJAX handlers do not verify that the gdpr-user ID belongs to the requester, and the required wpas-gdpr-nonce is exposed to all logged-in users on frontend plugin pages and the WordPress admin profile page, facilitating exploitation.

An attacker with subscriber-level access can perform stored XSS attacks, injecting malicious scripts that execute in other users' browsers when they access the injected pages. This can lead to information disclosure and session hijacking within the scope of the affected WordPress site. The vulnerability does not affect availability but impacts confidentiality and integrity.

No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict subscriber-level user privileges where possible and monitor for suspicious activity related to the gdpr-data parameter. Avoid exposing the wpas-gdpr-nonce unnecessarily if configurable.