The plugin does not sanitize or escape form values before saving to the database or when outputting, which allows high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Navigate to Tickets > Add New > add all information on the title, post, Ticket type, Ticket priority, Ticket status > click update and intercept the request using burp suite. The parameters “wats_select_ticket_type”, “wats_select_ticket_priority”, “wats_select_ticket_status” can be injected with cross-site scripting (XSS), such as test">; test"> payload. Next Click Forward on burp suite. To trigger the XSS payload, Open the permalink post/ticket page.