CVE-2022-38073 MEDIUM

CVE-2022-38073: WordPress Awesome Support plugin <= 6.0.7 - Multiple Authenticated Persistent XSS (Additional Interested Parties)

Vendor Awesome Support Team
Product Awesome Support (WordPress plugin)
Weakness CWE-79 · XSS
Published September 21, 2022
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

5.4/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

Multiple Authenticated (custom specific plugin role) Persistent Cross-Site Scripting (XSS) vulnerability in Awesome Support plugin <= 6.0.7 at WordPress.

Explanation of Vulnerability in Simple Terms

02Summary

The Awesome Support WordPress plugin version 6.0.7 and earlier contains a stored cross-site scripting (XSS) vulnerability. An authenticated user with low privileges can inject malicious scripts that execute in the browsers of other users, including site administrators. The vulnerability requires user interaction—typically clicking a link or visiting a page containing the payload. The impact extends beyond the plugin itself to affect the broader site.

What an attacker can do

03Attacker Capabilities

Inject malicious scripts that run in other users' browsers, potentially stealing session tokens or performing actions as those users.

Potential impact on your site

04Site Impact

Authenticated attackers can compromise admin accounts and modify site content or settings through stored XSS attacks.

Conditions required to exploit

05Prerequisites

Attacker must have a low-privilege account on the site. A victim must visit a page or click a link containing the malicious payload.

Key dates

06Disclosure timeline

September 21, 2022 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-15016 Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions <= 3.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting CVE-2025-9205 MapSVG Lite <= 8.14.0 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2026-65764 Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Maps 5.0.0-6.1.1 CVE-2026-65762 Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Guestbook 5.0.0-6.1.0 CVE-2026-15653 Visualizer <= 4.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'backend-title' Parameter