The Awesome Support plugin allows a stored cross‑site scripting vulnerability through the 'wpas_files' parameter when the drag‑n‑drop uploader is enabled, due to insufficient input sanitization and output escaping. This flaw enables an attacker who is able to authenticate to WordPress with custom‑level access or higher to inject and persist arbitrary JavaScript in pages accessed by other users. The injected script runs in the context of the victim’s session, potentially allowing credential theft, session hijacking, or defacement. This issue is a classic example of improper input validation (CWE‑79).

Affected systems include the Awesome Support – WordPress HelpDesk & Support Plugin for WordPress across all releases up to and including version 6.4.1. The vulnerability applies only when the setting 'Enable drag‑n‑drop uploader for ticket form' is turned on, a feature that is disabled by default. Administrators who grant custom‑level role permissions to users are therefore at higher risk. Ensuring the plugin is upgraded to a patched version or removing the feature from their configuration mitigates the problem.

The CVSS v3 score is 6.4, indicating a medium severity vulnerability. EPSS is not available for this entry, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw requires authenticated access, the likelihood of exploitation is limited to users with at least custom‑level permissions, making the overall risk moderate. No publicly disclosed exploits are known at this time, but the potential impact of a successful injection warrants prompt action.