An unauthenticated stored Cross-Site Scripting vulnerability in the WP Support Plus Responsive Ticket System plugin enables remote attackers to execute arbitrary scripts in user browsers.

The plugin suffers from improper file validation, permitting the upload of malicious HTML or SVG files. This allows unauthenticated attackers to inject and execute arbitrary JavaScript code within the browsers of site users and administrators.

With a CVSS score of 8.8, this high-severity vulnerability poses a major risk to site integrity and user data. Successful exploitation could lead to session hijacking, unauthorized administrative actions, or the redirection of site users to malicious domains, significantly damaging user trust and organizational reputation.

Immediate Action: Update the WP Support Plus Responsive Ticket System plugin to a version greater than 9.1.2 immediately.

Proactive Monitoring: Audit the media library and plugin upload directories for suspicious or unauthorized file types (e.g., .svg, .html) and monitor administrative logs for unusual account activity.

Compensating Controls: Utilize a Web Application Firewall (WAF) with strict file upload validation rules to block the submission of non-standard or executable file types.

Public Exploit Available: false

This vulnerability is highly dangerous as it allows for unauthenticated code execution within the browser context. Organizations must patch the plugin immediately and perform a thorough security audit of the web server to ensure no malicious files have already been uploaded.