CVE-2026-11589

HIGH

WP Support Plus Responsive Ticket System <= 9.1.2 - Unauthenticated Stored XSS via File Upload

Title source: cna
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-11589. PoCs published by HermesNA-1.

AI-analyzed exploit summary This repository contains an auto-generated stub module for CVE-2026-11589, a file upload vulnerability in the WP Support Plus Responsive Ticket System WordPress plugin (versions through 9.1.2). The code includes placeholder methods (`check` and `run`) but lacks actual exploit implementation, referencing external sources for PoC details.

Description

The WP Support Plus Responsive Ticket System WordPress plugin through 9.1.2 does not properly validate uploaded files, allowing unauthenticated users to upload files containing malicious JavaScript (such as HTML or SVG) to a publicly accessible location, leading to Stored Cross-Site Scripting attacks against site users and administrators.

Exploits (1)

github STUB 1 stars
by HermesNA-1 · pythonpoc
https://github.com/HermesNA-1/SnakeSploit/tree/main/data/modules_generated/cve-2026-11589_the_support_plus.py

This repository contains an auto-generated stub module for CVE-2026-11589, a file upload vulnerability in the WP Support Plus Responsive Ticket System WordPress plugin (versions through 9.1.2). The code includes placeholder methods (`check` and `run`) but lacks actual exploit implementation, referencing external sources for PoC details.

Classification
Stub 98%
Attack Type
Xss
Complexity
Moderate
Reliability
Theoretical
Target: WP Support Plus Responsive Ticket System WordPress plugin through 9.1.2
No auth needed
Prerequisites: Unauthenticated access to a vulnerable WordPress site with the plugin installed · Target server must accept file uploads via the plugin's interface
mistral-large-3 · analyzed Jul 09, 2026 Full analysis →

References (1)

Core 1
Core References
Exploit exploit vdb-entry technical-description
https://wpscan.com/vulnerability/c46479c2-4eef-485f-ae98-1f487efa4263/

Scores

CVSS v3 8.8
EPSS 0.0028
EPSS Percentile 19.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

Status published
Products (1)
None/WP Support Plus Responsive Ticket System < 9.1.2
Published Jun 30, 2026
Tracked Since Jun 30, 2026