Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-07
JS Help Desk - Security Vulnerability (CVE-2026-118046)
The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'jsticket_message' parameter in all versions up to, and including, 5.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload fires specifically when an administrator or agent opens the affected ticket and the page initializes VenoBox, which reads the…
PLUGIN
JS Help Desk
CVE-2026-118046
Risk Score
Threat Entry
Updated 2026-10-30
JS Help Desk - Security Vulnerability (CVE-2026-104739)
The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the setSupportCustomImage function in all versions up to, and including, 5.0.1. This makes it possible for authenticated attackers, with administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Exploitation requires a two-step sequence: an administrator first saves a traversal-crafted value in the support_custom_img configuration field,…
PLUGIN
JS Help Desk
CVE-2026-104739
Risk Score
Threat Entry
Updated 2026-08-26
JS Help Desk - Cross-Site Request Forgery (CSRF) (CVE-2026-14930)
The JS Help Desk WordPress plugin before 3.1.4 does not perform any authorization, nonce, or ownership check on a front-end request dispatcher, allowing unauthenticated users to upload files (limited to the JS Help Desk WordPress plugin before 3.1.4's inert allowed extensions) and attach them to arbitrary users' support tickets.
PLUGIN
JS Help Desk
CVE-2026-14930
Risk Score
Threat Entry
Updated 2026-08-26
JS Help Desk - Broken Access Control (CVE-2026-15209)
The JS Help Desk WordPress plugin before 3.1.5 does not verify that the requesting user owns the ticket being loaded: a low-privileged authenticated user can supply another user's ticket ID and read that ticket's contents, including the reporter's PII and message body.
PLUGIN
JS Help Desk
CVE-2026-15209
Risk Score
Threat Entry
Updated 2026-08-26
JS Help Desk - Broken Access Control (CVE-2026-14931)
The JS Help Desk WordPress plugin before 3.1.4 grants a support-agent capability to the Contributor role on activation and does not perform a capability check on a user-listing handler, allowing Contributor-level users to enumerate the email addresses of all registered WordPress users.
PLUGIN
JS Help Desk
CVE-2026-14931
Risk Score
Threat Entry
Updated 2026-08-26
JS Help Desk - Security Vulnerability (CVE-2026-14928)
The JS Help Desk WordPress plugin before 3.1.4 does not perform authorization or ownership checks before returning support-ticket content in a nonce-gated search handler, allowing any authenticated user (Subscriber and above) to read the subject and full message body of every other user's support tickets.
PLUGIN
JS Help Desk
CVE-2026-14928
Risk Score
Threat Entry
Updated 2026-08-26
JS Help Desk - Security Vulnerability (CVE-2026-14929)
The JS Help Desk WordPress plugin before 3.1.4 does not verify ownership of the targeted reply before updating it, allowing any authenticated user (Subscriber and above) to overwrite the content of any support-ticket reply on the site.
PLUGIN
JS Help Desk
CVE-2026-14929
Risk Score
Threat Entry
Updated 2026-06-25
JS Help Desk - Security Vulnerability (CVE-2026-56054)
Subscriber Arbitrary File Deletion in JS Help Desk
PLUGIN
JS Help Desk
CVE-2026-56054
Risk Score
Threat Entry
Updated 2026-06-17
JS Help Desk - SQL Injection (CVE-2026-48886)
Unauthenticated SQL Injection in JS Help Desk
PLUGIN
JS Help Desk
CVE-2026-48886
Risk Score
Threat Entry
Updated 2026-06-17
JS Help Desk - Broken Access Control (CVE-2026-48887)
Unauthenticated Broken Access Control in JS Help Desk
PLUGIN
JS Help Desk
CVE-2026-48887
Risk Score
Threat Entry
Updated 2026-06-17
JS Help Desk - SQL Injection (CVE-2026-2511)
The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to SQL Injection via the `multiformid` parameter in the `storeTickets()` function in all versions up to, and including, 3.0.4. This is due to the user-supplied `multiformid` value being passed to `esc_sql()` without enclosing the result in quotes in the SQL query, rendering the escaping ineffective against payloads that do not contain quote characters. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract…
PLUGIN
JS Help Desk
CVE-2026-2511
Risk Score
Threat Entry
Updated 2026-06-17
Js Help Desk - SQL Injection (CVE-2023-7337)
The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to SQL Injection via the 'js-support-ticket-token-tkstatus' cookie in version 2.8.2 due to an incomplete fix for CVE-2023-50839 where a second sink was left with insufficient escaping on the user supplied values and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Js Help Desk
CVE-2023-7337
Risk Score
Threat Entry
Updated 2026-06-17
Js Help Desk - SQL Injection (CVE-2025-30886)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JoomSky JS Help Desk js-support-ticket allows SQL Injection.This issue affects JS Help Desk: from n/a through
PLUGIN
Js Help Desk
CVE-2025-30886
Risk Score
Threat Entry
Updated 2026-06-17
Js Help Desk - Path Traversal (CVE-2025-30901)
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in JoomSky JS Help Desk js-support-ticket allows PHP Local File Inclusion.This issue affects JS Help Desk: from n/a through
PLUGIN
Js Help Desk
CVE-2025-30901
Risk Score
Threat Entry
Updated 2026-06-17
Js Help Desk - Path Traversal (CVE-2025-30882)
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in JoomSky JS Help Desk js-support-ticket allows Path Traversal.This issue affects JS Help Desk: from n/a through
PLUGIN
Js Help Desk
CVE-2025-30882
Risk Score
Threat Entry
Updated 2026-06-17
Js Help Desk - Path Traversal (CVE-2025-30878)
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in JoomSky JS Help Desk js-support-ticket allows Path Traversal.This issue affects JS Help Desk: from n/a through
PLUGIN
Js Help Desk
CVE-2025-30878
Risk Score
Threat Entry
Updated 2026-06-17
Js Help Desk - Broken Access Control (CVE-2025-30880)
Missing Authorization vulnerability in JoomSky JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through
PLUGIN
Js Help Desk
CVE-2025-30880
Risk Score
Threat Entry
Updated 2026-06-17
Js Help Desk - Information Disclosure (CVE-2024-13606)
The JS Help Desk – The Ultimate Help Desk & Support Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.8.8 via the 'jssupportticketdata' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/jssupportticketdata directory which can contain file attachments included in support tickets.
PLUGIN
Js Help Desk
CVE-2024-13606
Risk Score
Threat Entry
Updated 2026-06-17
JS Help Desk - Security Vulnerability (CVE-2024-13607)
The JS Help Desk – The Ultimate Help Desk & Support Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.8.8 via the 'exportusereraserequest' due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level permissions and above, to export ticket data for any user.
PLUGIN
JS Help Desk
CVE-2024-13607
Risk Score
Threat Entry
Updated 2026-06-17
Js Help Desk - Broken Access Control (CVE-2022-46838)
Missing Authorization vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.7.1.
PLUGIN
Js Help Desk
CVE-2022-46838
Risk Score