CVE-2026-11589

HighCVSS 8.8/10Last modified Jun 30, 2026

Description

The WP Support Plus Responsive Ticket System WordPress plugin through 9.1.2 does not properly validate uploaded files, allowing unauthenticated users to upload files containing malicious JavaScript (such as HTML or SVG) to a publicly accessible location, leading to Stored Cross-Site Scripting attacks against site users and administrators.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published: Jun 30, 2026
Last modified: Jun 30, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1158925.7Wasmtime is a runtime for WebAssembly. From 46.0.0 until 48.0.7 and 49.0.4, lowering a host-created component-model stream or future into a CVE-2026-1158939.9Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br CVE-2026-1158958.8Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. From 17.0.0 until 21.0.4, packages/happy-dom CVE-2026-1158972.1Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. Prior to 7.1.3, the CVE-2026-11599.8A weakness has been identified in itsourcecode Online Frozen Foods Ordering System 1.0. This issue affects some unknown processing of the fi CVE-2026-115908.6The WP Support Plus Responsive Ticket System WordPress plugin through 9.1.2 does not sanitize user-supplied array keys before using them in CVE-2026-115914.4The Widgets for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, a CVE-2026-115924.3The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress plugin for WordPress is vulnerab CVE-2026-1159296.8MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root certificate store. This root certificate store has t CVE-2026-1159319.9Postiz lets a signed-in user ask the backend to run a function on one of their connected channels. The backend did not restrict which functi CVE-2026-1159329.6When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that th CVE-2026-1159339.9Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A route