The Support Ticket plugin for WordPress does not correctly neutralize user input before inserting it into a generated web page, allowing attackers to inject malicious JavaScript into reflected responses. This reflected cross‑site scripting flaw can execute code in a victim’s browser, leading to potential cookie theft, unauthorized actions performed on behalf of the user, or defacement of the site’s content. The vulnerability is a client‑side attack that compromises the confidentiality and integrity of user sessions during interaction with the affected plugin pages.

The vulnerability applies to the WordPress Support Ticket Plugin from themepassion, affecting all releases up to and including version 1.9. No newer versions have been documented as vulnerable, but the credentialed user should verify the plugin’s current version after patching.

The CVSS score of 7.1 indicates a high severity and the EPSS score of less than 1% suggests that, while the vulnerability is serious, the likelihood of exploitation is currently low. The flaw is not listed in CISA’s KEV catalog. Attackers could exploit the flaw by crafting a URL that includes malicious JavaScript and persuading a site visitor to click on it, triggering the reflected code execution in the visitor’s browser. If the site is publicly accessible and the plugin’s pages are reachable, the risk is higher because any user could be targeted.