CVE-2026-11589

highCVSS 8.8covered by 1 sourcefirst seen 2026-06-30

The WP Support Plus Responsive Ticket System WordPress plugin through 9.1.2 does not properly validate uploaded files, allowing unauthenticated users to upload files containing malicious JavaScript (such as HTML or SVG) to a publicly accessible location, leading to Stored Cross-Site Scripting attacks against site users and administrators.

⚡ Watch CVE-2026-11589

Get an email if CVE-2026-11589 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.28% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 19% of all EPSS-scored CVEs.

Advisory coverage (1)

highCVE-2026-11589: The WP Support Plus Responsive Ticket System WordPress plugin through 9.1.2 does not properly …nvd · 2026-06-30

External references

NVD record for CVE-2026-11589

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-11589 status](https://www.csirts.com/badge/CVE-2026-11589)](https://www.csirts.com/cve/CVE-2026-11589)