Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 253,029 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · js-support-ticket
JS Help Desk
36 known vulnerabilities on record. Add your version above to see which ones affect you.
Oct 5, 2026JS Help Desk: Authorization Bypass Through User-Controlled KeyCVE-2026-103079 · affects up to 4.0.0 · reported by PatchstackMedium 5.4
Authorization Bypass Through User-Controlled Key vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through 4.0.0.
Oct 5, 2026JS Help Desk: Authorization Bypass Through User-Controlled KeyCVE-2026-103078 · affects up to 4.0.0 · reported by PatchstackMedium 4.3
Authorization Bypass Through User-Controlled Key vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through 4.0.0.
Jul 31, 2026JS Help Desk: Does not verify that the requesting user owns the ticket being loaded: a low-privileged authenticated user can supply another user's ticket ID and read that ticket's contentsCVE-2026-15209 · fixed in 3.1.5 · reported by WPScanMedium 6.5
The JS Help Desk WordPress plugin before 3.1.5 does not verify that the requesting user owns the ticket being loaded: a low-privileged authenticated user can supply another user's ticket ID and read that ticket's contents, including the reporter's PII and message body.
Jul 31, 2026JS Help Desk: Grants a support-agent capability to the Contributor role on activation and does not perform a capability check on a user-listing handlerCVE-2026-14931 · fixed in 3.1.4 · reported by WPScanMedium 6.5
The JS Help Desk WordPress plugin before 3.1.4 grants a support-agent capability to the Contributor role on activation and does not perform a capability check on a user-listing handler, allowing Contributor-level users to enumerate the email addresses of all registered WordPress users.
Jul 31, 2026JS Help Desk: Does not perform any authorizationCVE-2026-14930 · fixed in 3.1.4 · reported by WPScanHigh 7.5
The JS Help Desk WordPress plugin before 3.1.4 does not perform any authorization, nonce, or ownership check on a front-end request dispatcher, allowing unauthenticated users to upload files (limited to the JS Help Desk WordPress plugin before 3.1.4's inert allowed extensions) and attach them to arbitrary users' support tickets.
Jul 31, 2026JS Help Desk: Does not verify ownership of the targeted reply before updating itCVE-2026-14929 · fixed in 3.1.4 · reported by WPScanMedium 4.3
The JS Help Desk WordPress plugin before 3.1.4 does not verify ownership of the targeted reply before updating it, allowing any authenticated user (Subscriber and above) to overwrite the content of any support-ticket reply on the site.
Jul 31, 2026JS Help Desk: Does not perform authorization or ownership checks before returning support-ticket content in a nonce-gated search handlerCVE-2026-14928 · fixed in 3.1.4 · reported by WPScanMedium 6.5
The JS Help Desk WordPress plugin before 3.1.4 does not perform authorization or ownership checks before returning support-ticket content in a nonce-gated search handler, allowing any authenticated user (Subscriber and above) to read the subject and full message body of every other user's support tickets.
Jun 26, 2026Unauthenticated Insecure Direct Object References (IDOR) in JS Help Desk <= 3.1.0 versions.CVE-2026-57652 · reported by PatchstackMedium 5.3
Unauthenticated Insecure Direct Object References (IDOR) in JS Help Desk <= 3.1.0 versions.
Jun 25, 2026Subscriber Arbitrary File Deletion in JS Help Desk <= 3.1.1 versions.CVE-2026-56054 · affects up to 3.1.1 · reported by PatchstackHigh 7.7
Subscriber Arbitrary File Deletion in JS Help Desk <= 3.1.1 versions.
Jun 15, 2026Unauthenticated Broken Access Control in JS Help Desk <= 3.0.9 versions.CVE-2026-48887 · affects up to 3.0.9 · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in JS Help Desk <= 3.0.9 versions.
Jun 15, 2026Unauthenticated SQL Injection in JS Help Desk <= 3.0.9 versions.CVE-2026-48886 · affects up to 3.0.9 · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in JS Help Desk <= 3.0.9 versions.
Mar 26, 2026JS Help Desk – AI-Powered Support & Ticketing System: SQL InjectionCVE-2026-2511 · affects up to 3.0.4 · reported by WordfenceHigh 7.5
The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to SQL Injection via the `multiformid` parameter in the `storeTickets()` function in all versions up to, and including, 3.0.4. This is due to the user-supplied `multiformid` value being passed to `esc_sql()` without enclosing the result in quotes in the SQL query, rendering the escaping ineffective against payloads that do not contain quote characters. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 25, 2026JS Help Desk: Authorization Bypass Through User-Controlled KeyCVE-2026-32535 · affects up to 3.0.3 · reported by PatchstackMedium 6.5
Authorization Bypass Through User-Controlled Key vulnerability in JoomSky JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through <= 3.0.3.
Mar 25, 2026JS Help Desk: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-32534 · affects up to 3.0.3 · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JoomSky JS Help Desk js-support-ticket allows Blind SQL Injection.This issue affects JS Help Desk: from n/a through <= 3.0.3.
Mar 4, 2026JS Help Desk – AI-Powered Support & Ticketing System: SQL InjectionCVE-2023-7337 · reported by WordfenceHigh 7.5
The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to SQL Injection via the 'js-support-ticket-token-tkstatus' cookie in version 2.8.2 due to an incomplete fix for CVE-2023-50839 where a second sink was left with insufficient escaping on the user supplied values and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Feb 20, 2026JS Help Desk: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-24959 · affects up to 3.0.1 · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JoomSky JS Help Desk js-support-ticket allows Blind SQL Injection.This issue affects JS Help Desk: from n/a through <= 3.0.1.
Apr 1, 2025JS Help Desk: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-30901 · affects up to 2.9.2 · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in JoomSky JS Help Desk js-support-ticket allows PHP Local File Inclusion.This issue affects JS Help Desk: from n/a through <= 2.9.2.
Apr 1, 2025JS Help Desk: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30886 · affects up to 2.9.2 · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JoomSky JS Help Desk js-support-ticket allows SQL Injection.This issue affects JS Help Desk: from n/a through <= 2.9.2.
Apr 1, 2025JS Help Desk: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-30882 · affects up to 2.9.1 · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in JoomSky JS Help Desk js-support-ticket allows Path Traversal.This issue affects JS Help Desk: from n/a through <= 2.9.1.
Apr 1, 2025JS Help Desk: Missing AuthorizationCVE-2025-30880 · affects up to 2.9.2 · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in JoomSky JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through <= 2.9.2.
Apr 1, 2025JS Help Desk: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-30878 · affects up to 2.9.2 · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in JoomSky JS Help Desk js-support-ticket allows Path Traversal.This issue affects JS Help Desk: from n/a through <= 2.9.2.
Feb 13, 2025JS Help Desk – The Ultimate Help Desk & Support: Sensitive Information ExposureCVE-2024-13606 · affects up to 2.8.8 · reported by WordfenceHigh 7.5
The JS Help Desk – The Ultimate Help Desk & Support Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.8.8 via the 'jssupportticketdata' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/jssupportticketdata directory which can contain file attachments included in support tickets.
Feb 4, 2025JS Help Desk – The Ultimate Help Desk & Support: Insecure Direct Object ReferenceCVE-2024-13607 · affects up to 2.8.8 · reported by WordfenceMedium 4.3
The JS Help Desk – The Ultimate Help Desk & Support Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.8.8 via the 'exportusereraserequest' due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level permissions and above, to export ticket data for any user.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 13, 2024JS Help Desk – Best Help Desk & Support: Missing AuthorizationCVE-2022-46840 · affects up to 2.7.1 · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.7.1.
Dec 13, 2024JS Help Desk – Best Help Desk & Support: Missing AuthorizationCVE-2022-46838 · affects up to 2.7.1 · reported by PatchstackCritical 9.1
Missing Authorization vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.7.1.
Nov 9, 2024JS Help Desk: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51670 · affects up to 2.8.7 · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JoomSky JS Help Desk js-support-ticket allows Stored XSS.This issue affects JS Help Desk: from n/a through <= 2.8.7.
Nov 1, 2024JS Help Desk – Best Help Desk & Support: Missing AuthorizationCVE-2024-43274 · affects up to 2.8.6 · reported by PatchstackMedium 5.8
Missing Authorization vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.8.6.
Aug 12, 2024JS Help Desk – The Ultimate Help Desk & Support: PHP Code Injection leading to Remote Code ExecutionCVE-2024-7094 · affects up to 2.8.6 · reported by WordfenceCritical 9.8
The JS Help Desk – The Ultimate Help Desk & Support Plugin plugin for WordPress is vulnerable to PHP Code Injection leading to Remote Code Execution in all versions up to, and including, 2.8.6 via the 'storeTheme' function. This is due to a lack of sanitization on user-supplied values, which replace values in the style.php file, along with missing capability checks. This makes it possible for unauthenticated attackers to execute code on the server. This issue was partially patched in 2.8.6 when the code injection issue was resolved, and fully patched in 2.8.7 when the missing authorization and cross-site request forgery protection was added. CVE-2024-43274 is likely a duplicate of this issue.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 9, 2024JS Help Desk – Best Help Desk & Support: Missing AuthorizationCVE-2024-31273 · affects up to 2.8.3 · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.8.3.
May 17, 2024JS Help Desk – Best Help Desk & Support: Unrestricted Upload of File with Dangerous TypeCVE-2023-25444 · affects up to 2.7.7 · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin allows Using Malicious Files.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.7.7.
Apr 17, 2024JS Help Desk – Best Help Desk & Support: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2022-47151 · affects up to 2.7.1 · reported by PatchstackHigh 8.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.7.1.
Jan 5, 2024JS Help Desk – Best Help Desk & Support: Unrestricted Upload of File with Dangerous TypeCVE-2022-46839 · affects up to 2.7.1 · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.7.1.
Dec 28, 2023JS Help Desk – Best Help Desk & Support: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-50839 · affects up to 2.8.1 · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.8.1.
Jun 23, 2023JS Help Desk: Authorization Bypass Through User-Controlled KeyCVE-2023-23679 · affects up to 2.7.7 · reported by PatchstackMedium 4.6
Authorization Bypass Through User-Controlled Key vulnerability in JS Help Desk js-support-ticket allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JS Help Desk: from n/a through 2.7.7.
Feb 2, 2023Cross-Site Request Forgery (CSRF) vulnerability in JS Help Desk plugin <= 2.7.1 versions.CVE-2022-46842 · affects up to 2.7.1 · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in JS Help Desk plugin <= 2.7.1 versions.
Aug 27, 2019The js-support-ticket plugin before 2.0.6 for WordPress has CSRF.CVE-2018-21002 · fixed in 2.0.6 · reported by MITREHigh 8.8
The js-support-ticket plugin before 2.0.6 for WordPress has CSRF.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.