The vulnerability is a stored Cross‑Site Scripting flaw in the WordPress Awesome Support plugin. An attacker can inject malicious scripts through the subscriber interface, causing any visitor to run the code in the browser. This can lead to defacement, credential theft or the ability to perform further attacks against the site, significantly impacting confidentiality, integrity and availability.

Installations of the Awesome Support plugin for WordPress with any version up to and including 6.3.9 are affected. No other products are listed at this time.

The CVSS score of 7.1 indicates high severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, so no confirmed recent exploits are known. The attack appears to be a stored XSS submitted via the subscriber form, enabling an attacker who can supply input to trigger the payload as any user visits the page. Because the flaw is client‑side, no elevated privileges are required beyond the ability to post data to the vulnerable field.