Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

51 results · page 1 of 2

Oct 10, 2026Subscriber Arbitrary File Upload in CodeBard Help Desk <= 1.1.2 versions.CVE-2026-62024 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Subscriber Arbitrary File Upload in CodeBard Help Desk <= 1.1.2 versions.
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 5, 2026JS Help Desk: Authorization Bypass Through User-Controlled KeyCVE-2026-103079 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authorization Bypass Through User-Controlled Key vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through 4.0.0.
Product
JS Help Desk
Affected
up to 4.0.0
What to do
Affects up to 4.0.0. Update JS Help Desk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 5, 2026JS Help Desk: Authorization Bypass Through User-Controlled KeyCVE-2026-103078 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authorization Bypass Through User-Controlled Key vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through 4.0.0.
Product
JS Help Desk
Affected
up to 4.0.0
What to do
Affects up to 4.0.0. Update JS Help Desk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 31, 2026JS Help Desk: Does not verify that the requesting user owns the ticket being loaded: a low-privileged authenticated user can supply another user's ticket ID and read that ticket's contentsCVE-2026-15209 · WordPress plugins & themes · reported by WPScanMedium 6.5
The JS Help Desk WordPress plugin before 3.1.5 does not verify that the requesting user owns the ticket being loaded: a low-privileged authenticated user can supply another user's ticket ID and read that ticket's contents, including the reporter's PII and message body.
Product
JS Help Desk
Fixed in
3.1.5
What to do
Update JS Help Desk to 3.1.5 or newer.
Full record and what to do →NVD record wpscan.com
Jul 31, 2026JS Help Desk: Grants a support-agent capability to the Contributor role on activation and does not perform a capability check on a user-listing handlerCVE-2026-14931 · WordPress plugins & themes · reported by WPScanMedium 6.5
The JS Help Desk WordPress plugin before 3.1.4 grants a support-agent capability to the Contributor role on activation and does not perform a capability check on a user-listing handler, allowing Contributor-level users to enumerate the email addresses of all registered WordPress users.
Product
JS Help Desk
Fixed in
3.1.4
What to do
Update JS Help Desk to 3.1.4 or newer.
Full record and what to do →NVD record wpscan.com
Jul 31, 2026JS Help Desk: Does not perform any authorizationCVE-2026-14930 · WordPress plugins & themes · reported by WPScanHigh 7.5
The JS Help Desk WordPress plugin before 3.1.4 does not perform any authorization, nonce, or ownership check on a front-end request dispatcher, allowing unauthenticated users to upload files (limited to the JS Help Desk WordPress plugin before 3.1.4's inert allowed extensions) and attach them to arbitrary users' support tickets.
Product
JS Help Desk
Fixed in
3.1.4
What to do
Update JS Help Desk to 3.1.4 or newer.
Full record and what to do →NVD record wpscan.com
Jul 31, 2026JS Help Desk: Does not verify ownership of the targeted reply before updating itCVE-2026-14929 · WordPress plugins & themes · reported by WPScanMedium 4.3
The JS Help Desk WordPress plugin before 3.1.4 does not verify ownership of the targeted reply before updating it, allowing any authenticated user (Subscriber and above) to overwrite the content of any support-ticket reply on the site.
Product
JS Help Desk
Fixed in
3.1.4
What to do
Update JS Help Desk to 3.1.4 or newer.
Full record and what to do →NVD record wpscan.com
Jul 31, 2026JS Help Desk: Does not perform authorization or ownership checks before returning support-ticket content in a nonce-gated search handlerCVE-2026-14928 · WordPress plugins & themes · reported by WPScanMedium 6.5
The JS Help Desk WordPress plugin before 3.1.4 does not perform authorization or ownership checks before returning support-ticket content in a nonce-gated search handler, allowing any authenticated user (Subscriber and above) to read the subject and full message body of every other user's support tickets.
Product
JS Help Desk
Fixed in
3.1.4
What to do
Update JS Help Desk to 3.1.4 or newer.
Full record and what to do →NVD record wpscan.com
Jul 11, 2026Majestic Support – The Leading-Edge Help Desk & Customer Support: Generic SQL InjectionCVE-2026-13262 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin for WordPress is vulnerable to generic SQL Injection via the 'val' parameter in all versions up to, and including, 1.1.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires a valid 'get-smart-reply' nonce, which any Subscriber-level user can obtain by creating a ticket via the public frontend and visiting the resulting ticket detail page, making this effectively exploitable by any authenticated user.
Product
Majestic Support – The Leading-Edge Help Desk & Customer Support
Affected
up to 1.1.9
What to do
Affects up to 1.1.9. Update Majestic Support – The Leading-Edge Help Desk & Customer Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 26, 2026Unauthenticated Insecure Direct Object References (IDOR) in JS Help Desk <= 3.1.0 versions.CVE-2026-57652 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Insecure Direct Object References (IDOR) in JS Help Desk <= 3.1.0 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 25, 2026Subscriber Arbitrary File Deletion in JS Help Desk <= 3.1.1 versions.CVE-2026-56054 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Subscriber Arbitrary File Deletion in JS Help Desk <= 3.1.1 versions.
Affected
up to 3.1.1
What to do
Affects up to 3.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 15, 2026Unauthenticated Broken Access Control in JS Help Desk <= 3.0.9 versions.CVE-2026-48887 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in JS Help Desk <= 3.0.9 versions.
Affected
up to 3.0.9
What to do
Affects up to 3.0.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 15, 2026Unauthenticated SQL Injection in JS Help Desk <= 3.0.9 versions.CVE-2026-48886 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in JS Help Desk <= 3.0.9 versions.
Affected
up to 3.0.9
What to do
Affects up to 3.0.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 26, 2026JS Help Desk – AI-Powered Support & Ticketing System: SQL InjectionCVE-2026-2511 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to SQL Injection via the `multiformid` parameter in the `storeTickets()` function in all versions up to, and including, 3.0.4. This is due to the user-supplied `multiformid` value being passed to `esc_sql()` without enclosing the result in quotes in the SQL query, rendering the escaping ineffective against payloads that do not contain quote characters. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
JS Help Desk – AI-Powered Support & Ticketing System
Affected
up to 3.0.4
What to do
Affects up to 3.0.4. Update JS Help Desk – AI-Powered Support & Ticketing System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 25, 2026JS Help Desk: Authorization Bypass Through User-Controlled KeyCVE-2026-32535 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Authorization Bypass Through User-Controlled Key vulnerability in JoomSky JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through <= 3.0.3.
Product
JS Help Desk
Affected
up to 3.0.3
What to do
Affects up to 3.0.3. Update JS Help Desk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026JS Help Desk: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-32534 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JoomSky JS Help Desk js-support-ticket allows Blind SQL Injection.This issue affects JS Help Desk: from n/a through <= 3.0.3.
Product
JS Help Desk
Affected
up to 3.0.3
What to do
Affects up to 3.0.3. Update JS Help Desk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 4, 2026JS Help Desk – AI-Powered Support & Ticketing System: SQL InjectionCVE-2023-7337 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to SQL Injection via the 'js-support-ticket-token-tkstatus' cookie in version 2.8.2 due to an incomplete fix for CVE-2023-50839 where a second sink was left with insufficient escaping on the user supplied values and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
JS Help Desk – AI-Powered Support & Ticketing System
What to do
Update JS Help Desk – AI-Powered Support & Ticketing System to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 20, 2026JS Help Desk: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-24959 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JoomSky JS Help Desk js-support-ticket allows Blind SQL Injection.This issue affects JS Help Desk: from n/a through <= 3.0.1.
Product
JS Help Desk
Affected
up to 3.0.1
What to do
Affects up to 3.0.1. Update JS Help Desk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 6, 2025Hive Support | AI-Powered Help Desk, Live Chat & AI Chat Bot Plugin for: Cross-Site Request ForgeryCVE-2025-5019 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Hive Support | AI-Powered Help Desk, Live Chat & AI Chat Bot Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.5. This is due to missing or incorrect nonce validation on the hs_update_ai_chat_settings() function. This makes it possible for unauthenticated attackers to reconfigure the plugin’s AI/chat settings (including API keys) and to potentially redirect notifications or leak data to attacker-controlled endpoints via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Hive Support | AI-Powered Help Desk, Live Chat & AI Chat Bot Plugin for
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update Hive Support | AI-Powered Help Desk, Live Chat & AI Chat Bot Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 1, 2025JS Help Desk: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-30901 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in JoomSky JS Help Desk js-support-ticket allows PHP Local File Inclusion.This issue affects JS Help Desk: from n/a through <= 2.9.2.
Product
JS Help Desk
Affected
up to 2.9.2
What to do
Affects up to 2.9.2. Update JS Help Desk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025JS Help Desk: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30886 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JoomSky JS Help Desk js-support-ticket allows SQL Injection.This issue affects JS Help Desk: from n/a through <= 2.9.2.
Product
JS Help Desk
Affected
up to 2.9.2
What to do
Affects up to 2.9.2. Update JS Help Desk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025JS Help Desk: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-30882 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in JoomSky JS Help Desk js-support-ticket allows Path Traversal.This issue affects JS Help Desk: from n/a through <= 2.9.1.
Product
JS Help Desk
Affected
up to 2.9.1
What to do
Affects up to 2.9.1. Update JS Help Desk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025JS Help Desk: Missing AuthorizationCVE-2025-30880 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in JoomSky JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through <= 2.9.2.
Product
JS Help Desk
Affected
up to 2.9.2
What to do
Affects up to 2.9.2. Update JS Help Desk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025JS Help Desk: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-30878 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in JoomSky JS Help Desk js-support-ticket allows Path Traversal.This issue affects JS Help Desk: from n/a through <= 2.9.2.
Product
JS Help Desk
Affected
up to 2.9.2
What to do
Affects up to 2.9.2. Update JS Help Desk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 13, 2025JS Help Desk – The Ultimate Help Desk & Support: Sensitive Information ExposureCVE-2024-13606 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The JS Help Desk – The Ultimate Help Desk & Support Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.8.8 via the 'jssupportticketdata' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/jssupportticketdata directory which can contain file attachments included in support tickets.
Product
JS Help Desk – The Ultimate Help Desk & Support
Affected
up to 2.8.8
What to do
Affects up to 2.8.8. Update JS Help Desk – The Ultimate Help Desk & Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 12, 2025Majestic Support – The Leading-Edge Help Desk & Customer Support: Insecure Direct Object ReferenceCVE-2024-13601 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.0.5 via the 'exportusereraserequest' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to export ticket data for any user.
Product
Majestic Support – The Leading-Edge Help Desk & Customer Support
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update Majestic Support – The Leading-Edge Help Desk & Customer Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 12, 2025Majestic Support – The Leading-Edge Help Desk & Customer Support: Sensitive Information ExposureCVE-2024-13600 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.5 via the 'majesticsupportdata' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/majesticsupportdata directory which can contain file attachments included in support tickets.
Product
Majestic Support – The Leading-Edge Help Desk & Customer Support
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update Majestic Support – The Leading-Edge Help Desk & Customer Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 4, 2025JS Help Desk – The Ultimate Help Desk & Support: Insecure Direct Object ReferenceCVE-2024-13607 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The JS Help Desk – The Ultimate Help Desk & Support Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.8.8 via the 'exportusereraserequest' due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level permissions and above, to export ticket data for any user.
Product
JS Help Desk – The Ultimate Help Desk & Support
Affected
up to 2.8.8
What to do
Affects up to 2.8.8. Update JS Help Desk – The Ultimate Help Desk & Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 31, 2025CodeBard Help Desk: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22757 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeBard CodeBard Help Desk codebard-help-desk allows Stored XSS.This issue affects CodeBard Help Desk: from n/a through <= 1.1.2.
Product
CodeBard Help Desk
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update CodeBard Help Desk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 15, 2025CodeBard Help Desk: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22760 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeBard CodeBard Help Desk codebard-help-desk allows Reflected XSS.This issue affects CodeBard Help Desk: from n/a through <= 1.1.2.
Product
CodeBard Help Desk
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update CodeBard Help Desk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2024CodeBard Help Desk: Cross-Site Request Forgery (CSRF)CVE-2024-56222 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in CodeBard CodeBard Help Desk codebard-help-desk allows Cross Site Request Forgery.This issue affects CodeBard Help Desk: from n/a through <= 1.1.1.
Product
CodeBard Help Desk
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update CodeBard Help Desk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024JS Help Desk – Best Help Desk & Support: Missing AuthorizationCVE-2022-46840 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.7.1.
Product
JS Help Desk – Best Help Desk & Support
Affected
up to 2.7.1
What to do
Affects up to 2.7.1. Update JS Help Desk – Best Help Desk & Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024JS Help Desk – Best Help Desk & Support: Missing AuthorizationCVE-2022-46838 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Missing Authorization vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.7.1.
Product
JS Help Desk – Best Help Desk & Support
Affected
up to 2.7.1
What to do
Affects up to 2.7.1. Update JS Help Desk – Best Help Desk & Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Assist24 Help Desk: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51910 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ezlab Assist24 Help Desk assist24it allows DOM-Based XSS.This issue affects Assist24 Help Desk: from n/a through <= 20150401.2.
Product
Assist24 Help Desk
Affected
up to 20150401.2
What to do
Affects up to 20150401.2. Update Assist24 Help Desk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024JS Help Desk: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51670 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JoomSky JS Help Desk js-support-ticket allows Stored XSS.This issue affects JS Help Desk: from n/a through <= 2.8.7.
Product
JS Help Desk
Affected
up to 2.8.7
What to do
Affects up to 2.8.7. Update JS Help Desk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024JS Help Desk – Best Help Desk & Support: Missing AuthorizationCVE-2024-43274 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Missing Authorization vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.8.6.
Product
JS Help Desk – Best Help Desk & Support
Affected
up to 2.8.6
What to do
Affects up to 2.8.6. Update JS Help Desk – Best Help Desk & Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 5, 2024WP Ticket Ultra Help Desk & Support: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-44011 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ExpressTech Systems WP Ticket Ultra Help Desk & Support Plugin wp-ticket-ultra allows PHP Local File Inclusion.This issue affects WP Ticket Ultra Help Desk & Support Plugin: from n/a through <= 1.0.5.
Product
WP Ticket Ultra Help Desk & Support
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update WP Ticket Ultra Help Desk & Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 1, 2024KB Support – WordPress Help Desk and Knowledge Base: Unauthorized access and modification of dataCVE-2024-8632 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The KB Support – WordPress Help Desk and Knowledge Base plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the 'kbs_ajax_load_front_end_replies' and 'kbs_ajax_mark_reply_as_read' functions in all versions up to, and including, 1.6.6. This makes it possible for unauthenticated attackers to read replies of any ticket, and mark any reply as read.
Product
KB Support – WordPress Help Desk and Knowledge Base
Affected
up to 1.6.6
What to do
Affects up to 1.6.6. Update KB Support – WordPress Help Desk and Knowledge Base to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 1, 2024KB Support – WordPress Help Desk and Knowledge Base: Unauthorized modification and loss of dataCVE-2024-8548 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The KB Support – WordPress Help Desk and Knowledge Base plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on several functions in the /includes/ajax-functions.php file all versions up to, and including, 1.6.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform multiple administrative actions, such as replying to arbitrary tickets, updating the status of any post, deleting any post, adding notes to tickets, flagging or unflagging tickets, and adding or removing ticket participants.
Product
KB Support – WordPress Help Desk and Knowledge Base
Affected
up to 1.6.6
What to do
Affects up to 1.6.6. Update KB Support – WordPress Help Desk and Knowledge Base to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 12, 2024JS Help Desk – The Ultimate Help Desk & Support: PHP Code Injection leading to Remote Code ExecutionCVE-2024-7094 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The JS Help Desk – The Ultimate Help Desk & Support Plugin plugin for WordPress is vulnerable to PHP Code Injection leading to Remote Code Execution in all versions up to, and including, 2.8.6 via the 'storeTheme' function. This is due to a lack of sanitization on user-supplied values, which replace values in the style.php file, along with missing capability checks. This makes it possible for unauthenticated attackers to execute code on the server. This issue was partially patched in 2.8.6 when the code injection issue was resolved, and fully patched in 2.8.7 when the missing authorization and cross-site request forgery protection was added. CVE-2024-43274 is likely a duplicate of this issue.
Product
JS Help Desk – The Ultimate Help Desk & Support
Affected
up to 2.8.6
What to do
Affects up to 2.8.6. Update JS Help Desk – The Ultimate Help Desk & Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 9, 2024JS Help Desk – Best Help Desk & Support: Missing AuthorizationCVE-2024-31273 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.8.3.
Product
JS Help Desk – Best Help Desk & Support
Affected
up to 2.8.3
What to do
Affects up to 2.8.3. Update JS Help Desk – Best Help Desk & Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024JS Help Desk – Best Help Desk & Support: Unrestricted Upload of File with Dangerous TypeCVE-2023-25444 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin allows Using Malicious Files.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.7.7.
Product
JS Help Desk – Best Help Desk & Support
Affected
up to 2.7.7
What to do
Affects up to 2.7.7. Update JS Help Desk – Best Help Desk & Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024JS Help Desk – Best Help Desk & Support: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2022-47151 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.7.1.
Product
JS Help Desk – Best Help Desk & Support
Affected
up to 2.7.1
What to do
Affects up to 2.7.1. Update JS Help Desk – Best Help Desk & Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 5, 2024JS Help Desk – Best Help Desk & Support: Unrestricted Upload of File with Dangerous TypeCVE-2022-46839 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.7.1.
Product
JS Help Desk – Best Help Desk & Support
Affected
up to 2.7.1
What to do
Affects up to 2.7.1. Update JS Help Desk – Best Help Desk & Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 28, 2023JS Help Desk – Best Help Desk & Support: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-50839 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.8.1.
Product
JS Help Desk – Best Help Desk & Support
Affected
up to 2.8.1
What to do
Affects up to 2.8.1. Update JS Help Desk – Best Help Desk & Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023KB Support – WordPress Help Desk and Knowledge Base: Missing AuthorizationCVE-2023-37890 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPOmnia KB Support – WordPress Help Desk and Knowledge Base allows Accessing Functionality Not Properly Constrained by ACLs. Users with a role as low as a subscriber can view other customers.This issue affects KB Support – WordPress Help Desk and Knowledge Base: from n/a through 1.5.88.
Product
KB Support – WordPress Help Desk and Knowledge Base
Affected
up to 1.5.88
What to do
Affects up to 1.5.88. Update KB Support – WordPress Help Desk and Knowledge Base to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 23, 2023JS Help Desk: Authorization Bypass Through User-Controlled KeyCVE-2023-23679 · WordPress plugins & themes · reported by PatchstackMedium 4.6
Authorization Bypass Through User-Controlled Key vulnerability in JS Help Desk js-support-ticket allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JS Help Desk: from n/a through 2.7.7.
Product
JS Help Desk
Affected
up to 2.7.7
What to do
Affects up to 2.7.7. Update JS Help Desk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 15, 2023Help Desk WP: Does not sanitise and escape some parametersCVE-2023-1019 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Help Desk WP WordPress plugin through 1.2.0 does not sanitise and escape some parameters, which could allow users with a role as low as Editor to perform Cross-Site Scripting attacks.
Product
Help Desk WP
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update Help Desk WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 2, 2023Ruby Help Desk: Does not ensure that the ticket being modified belongs to the user making the requestCVE-2023-1125 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Ruby Help Desk WordPress plugin before 1.3.4 does not ensure that the ticket being modified belongs to the user making the request, allowing an attacker to close and/or add files and replies to tickets other than their own.
Product
Ruby Help Desk
Fixed in
1.3.4
What to do
Update Ruby Help Desk to 1.3.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 2, 2023Cross-Site Request Forgery (CSRF) vulnerability in JS Help Desk plugin <= 2.7.1 versions.CVE-2022-46842 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in JS Help Desk plugin <= 2.7.1 versions.
Affected
up to 2.7.1
What to do
Affects up to 2.7.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.