An improper neutralization of user input in the WP Ticket Customer Service Software & Support Ticket System plugin allows attackers to store malicious scripts that are later served to all site visitors. The vulnerability is a stored XSS flaw that could enable attackers to steal session cookies, deface pages, or perform phishing attacks against authenticated users.

The affected product is the emarket‑design WP Ticket Customer Service Software & Support Ticket System plugin for WordPress, with versions from the initial release through 6.0.2 inclusive. Any WordPress installation using one of these plugin versions is vulnerable.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% suggests a very low likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by submitting malicious content through ticket or customer input fields, which will then be rendered unfiltered to all users, making the impact potentially widespread within the affected site. As the flaw is stored rather than reflected, compromising the plugin does not require the victim’s interaction with a specially crafted link, increasing the risk profile for attackers who can inject payloads via the plugin’s interface.