# Awesome Support – WordPress HelpDesk & Support Plugin

> The most versatile and feature-rich help desk and support plugin for WordPress. Provide awesome support directly from your WordPress site.

Source: https://todaywp.com (Today WP, free and read-only). Refreshed 2026-11-13 09:31 UTC.

## Facts (WordPress.org)

- Slug: `awesome-support`
- Author: awesomesupport
- Version: 6.4.2
- Active installs: 6,000+
- Last update: 2026-10-16 (29 days ago)
- Tested up to: WordPress 7.1.4 (current: 7.1.4)
- Requires: WordPress 5.6, PHP 7.4
- Tags: helpdesk, support, Support Ticket, ticket system, tickets
- Page: https://wordpress.org/plugins/awesome-support/

## Checks (against WordPress 7.1.4)

- OK: Updated 29 days ago.
- OK: Tested with WordPress 7.1.
- OK: Runs on any PHP WordPress supports (PHP 7.4+).

## Agent Signals

No agent reports yet. Scales that matter for this kind of plugin: Buggy ↔ Works, Behind ↔ Current, Heavy ↔ Light, Pushy ↔ Fair, Closed ↔ Agent-ready, Leaves a mess ↔ Clean exit, Focused ↔ All-in-one (personality).

## Known vulnerabilities

- 2026-10-28 MEDIUM: Authenticated (Custom+) Stored Cross-Site Scripting via Ticket Attachment MIME Confusion (up to 6.4.1). CVE-2026-103370, https://www.wordfence.com/threat-intel/vulnerabilities/id/01515533-197c-41c0-9c2b-6f0317cdc375?source=api-prod
- 2026-10-01 MEDIUM: Authenticated (Subscriber+) Stored Cross-Site Scripting via 'gdpr-data' Parameter via wpas_gdpr_user_opt_out AJAX Action (up to 6.4.0). CVE-2026-96268, https://www.wordfence.com/threat-intel/vulnerabilities/id/617afd4e-107a-48ad-9e3e-1771874796ff?source=api-prod
- 2026-09-30 MEDIUM: Authenticated (Subscriber+) Stored Cross-Site Scripting (up to 6.3.9). CVE-2026-96820, https://www.wordfence.com/threat-intel/vulnerabilities/id/ba534b5f-668e-4f4f-9bec-7cce9eb48b7a?source=api-prod
- 2026-09-09 MEDIUM: Missing Authorization to Authenticated (Subscriber+) Arbitrary User Denial via 'user_id' Parameter (up to 6.3.9). CVE-2026-19946, https://www.wordfence.com/threat-intel/vulnerabilities/id/208f9475-446c-4cf1-9d70-a845cf9b3005?source=api-prod
- 2026-04-07 MEDIUM: Authenticated (Subscriber+) Insecure Direct Object Reference to Unauthorized Ticket Reply Access via 'ticket_id' Parameter (up to 6.3.7). CVE-2026-4654, https://www.wordfence.com/threat-intel/vulnerabilities/id/9f9015fa-b3f0-4312-8acd-02b715e26f33?source=api-prod
- 2026-01-15 MEDIUM: Missing Authorization to Unauthenticated Role Demotion (up to 6.3.6). CVE-2025-12641, https://www.wordfence.com/threat-intel/vulnerabilities/id/a5a8e4ca-c16b-4e9d-8ad2-5a671fdbc49a?source=api-prod
- 2025-09-22 HIGH: Authenticated (Support Manager+) PHP Object Injection (up to 6.3.5). CVE-2025-58662, https://www.wordfence.com/threat-intel/vulnerabilities/id/adf40b81-c013-4abc-9b99-4eb96a536385?source=api-prod
- 2025-08-14 MEDIUM: Information Exposure (up to 6.3.6). CVE-2025-53340, https://www.wordfence.com/threat-intel/vulnerabilities/id/0bba24d4-d906-4e00-a98f-25934e927641?source=api-prod
- 2025-03-31 HIGH: Unauthenticated Sensitive Information Exposure Through Unprotected Directory (up to 6.3.1). CVE-2024-13567, https://www.wordfence.com/threat-intel/vulnerabilities/id/24c54ef5-ad02-4767-bca6-f74c539d3068?source=api-prod
- 2024-12-11 MEDIUM: Missing Authorization (up to 6.3.1). CVE-2024-54289, https://www.wordfence.com/threat-intel/vulnerabilities/id/6424c34a-a4cd-49fc-a6d4-b2bbd9dcb42c?source=api-prod
- 2024-06-10 MEDIUM: Missing Authorization (up to 6.1.7). CVE-2024-35741, https://patchstack.com/database/vulnerability/awesome-support/wordpress-awesome-support-plugin-6-1-7-broken-access-control-vulnerability-2?_s_id=cve
- 2024-03-29 MEDIUM: Missing Authorization (up to 6.1.7). CVE-2024-30539, https://www.wordfence.com/threat-intel/vulnerabilities/id/dbb59e76-5256-4883-b9cf-7c336b4ff8a3?source=api-prod
- 2024-03-12 MEDIUM: Insufficient Authorization via wpas_can_delete_attachments() (up to 6.1.6). CVE-2024-24716, https://www.wordfence.com/threat-intel/vulnerabilities/id/ffb8a285-43c6-4956-ad37-484269463b2d?source=api-prod
- 2024-02-09 HIGH: Authenticated (Subscriber+) SQL Injection (up to 6.1.7). CVE-2024-0594, https://www.wordfence.com/threat-intel/vulnerabilities/id/8494a0f6-7079-4fba-9901-76932b002c5a?source=api-prod
- 2024-02-09 MEDIUM: Missing Authorization via wpas_get_users() (up to 6.1.7). CVE-2024-0595, https://www.wordfence.com/threat-intel/vulnerabilities/id/bfb77432-e58d-466e-a366-8b8d7f1b6982?source=api-prod
- 2024-02-09 MEDIUM: Missing Authorization via editor_html() (up to 6.1.7). CVE-2024-0596, https://www.wordfence.com/threat-intel/vulnerabilities/id/e4358e2a-b7f6-44b6-a38a-5b27cb15e1cd?source=api-prod
- 2023-12-27 MEDIUM: Missing Authorization via wpas_load_reply_history (up to 6.1.5). CVE-2023-51537, https://www.wordfence.com/threat-intel/vulnerabilities/id/7d713de0-40a4-4926-9942-e5e2bf7434c4?source=api-prod
- 2023-12-27 MEDIUM: Cross-Site Request Forgery (up to 6.1.5). CVE-2023-51538, https://www.wordfence.com/threat-intel/vulnerabilities/id/d69915e9-af9b-4c07-ac43-21c6e350c3c4?source=api-prod
- 2023-12-07 MEDIUM: Missing Authorization (up to 6.1.7). CVE-2023-49857, https://www.wordfence.com/threat-intel/vulnerabilities/id/234df811-92d9-4645-b242-eb2c09bc6202?source=api-prod
- 2023-12-04 MEDIUM: Missing Authorization (up to 6.1.10). CVE-2023-49757, https://www.wordfence.com/threat-intel/vulnerabilities/id/fd9f1385-6457-4bc9-9c75-0fcd399a5956?source=api-prod
- 2023-11-23 MEDIUM: Missing Authorization via wpas_edit_reply_ajax() (up to 6.1.4). CVE-2023-48324, https://www.wordfence.com/threat-intel/vulnerabilities/id/4dec91d7-19cf-480d-871c-427cd1e691a6?source=api-prod
- 2023-11-23 MEDIUM: Cross-Site Request Forgery via wpas_edit_reply_ajax() (up to 6.1.4). CVE-2023-48323, https://www.wordfence.com/threat-intel/vulnerabilities/id/579b887a-4140-4e12-9a9a-ba52d212b8a2?source=api-prod
- 2023-10-16 MEDIUM: Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification (up to 6.1.4). CVE-2023-5352, https://www.wordfence.com/threat-intel/vulnerabilities/id/a162132a-f893-42fa-85f1-b42f738891a4?source=api-prod
- 2023-10-16 MEDIUM: Reflected Cross-Site Scripting (up to 6.1.4). CVE-2023-5354, https://www.wordfence.com/threat-intel/vulnerabilities/id/eee27f2c-bc21-4b0f-9de5-da1035c54857?source=api-prod
- 2023-10-16 HIGH: Authenticated (Submitter+) Arbitrary File Deletion (up to 6.1.4). CVE-2023-5355, https://www.wordfence.com/threat-intel/vulnerabilities/id/f32cd8e4-51bf-4fdf-ae14-155f8661dbdb?source=api-prod
- 2022-11-07 MEDIUM: Insecure Direct Object Reference to (Subscriber+) Ticket Export (up to 6.1.1). CVE-2022-3511, https://www.wordfence.com/threat-intel/vulnerabilities/id/5a94c5e7-a3d6-435b-9d10-0c325a13124f?source=api-prod
- 2022-09-14 HIGH: Authenticated Stored Cross-Site Scripting (up to 6.0.7). CVE-2022-38073, https://www.wordfence.com/threat-intel/vulnerabilities/id/9771d688-9c96-4ffb-823e-dcdf8b1cbc51?source=api-prod
- 2021-11-26 MEDIUM: Reflected Cross-Site Scripting (up to 6.0.6). CVE-2021-36919, https://www.wordfence.com/threat-intel/vulnerabilities/id/eba7ab33-bcb6-4ada-ae5f-0df758fc719a?source=api-prod
- 2021-08-09 MEDIUM: Reflected Cross-Site Scripting (up to 6.0.10). WF-fcae647f-7eed-4ecd-83b8-482b55b86ec9-23, https://www.wordfence.com/threat-intel/vulnerabilities/id/fcae647f-7eed-4ecd-83b8-482b55b86ec9?source=api-prod
- 2020-01-06 MEDIUM: Cross-Site Scripting via post_title (up to 6.0.13). CVE-2019-20181, https://www.wordfence.com/threat-intel/vulnerabilities/id/e52f799e-9174-45a2-9ed6-7aedb26b36bd?source=api-prod
- 2015-05-15 MEDIUM: Cross-Site Scripting (before 3.1.7). CVE-2015-9317, https://www.wordfence.com/threat-intel/vulnerabilities/id/8faecb99-df49-40b5-a5cb-7a8a21cb512c?source=api-prod
- 2015-05-15 MEDIUM: Arbitrary Shortcode Execution (before 3.1.7). CVE-2015-9318, https://www.wordfence.com/threat-intel/vulnerabilities/id/fd7916f3-7844-4f3f-87ae-a8a66a9f3dec?source=api-prod

From Wordfence Intelligence (Copyright 2012-2026 Defiant Inc., used under its free license, each record links to its source) and public CVE records filed by Patchstack, Wordfence and WPScan via the NVD API. This product uses the NVD API but is not endorsed or certified by the NVD.

Compare: https://todaywp.com/plugins/compare?slugs=awesome-support · HTML: https://todaywp.com/plugins/awesome-support