Threats tagged 'ghsa-h736-44v7-5c35'

The Awesome Support WordPress plugin versions up to and including 6.4.1 contain a stored cross-site scripting (XSS) vulnerability via the 'wpas_files' parameter. This flaw allows authenticated users with custom-level access or higher to inject malicious scripts that execute when other users view the affected pages. Exploitation requires the 'Enable drag-n-drop uploader for ticket form' setting to be enabled, which is disabled by default.