Cross-site scripting in WP Support Plus Responsive Ticket System - CVE-2019-7299
Published: April 12, 2019
WP Support Plus Responsive Ticket System
Detailed vulnerability description
Vulnerability allows a remote attacker to perform Cross-site scripting attacks.
An input validation error exists in the submit_ticket.php module in the WP Support Plus Responsive Ticket System plugin 9.1.1 for WordPress when processing subject parameter in wp-content/plugins/wp-support-plus-responsive-ticket-system/includes/ajax/submit_ticket.php. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in victim's browser in security context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.