VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

JS Help Desk – AI-Powered Support & Ticketing System security & vulnerabilities

js-support-ticket— active installsLast vulnerability Nov 7, 2026

No known unpatched vulnerabilities in the latest version

All 38 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin
38Known vulnerabilities
  • Critical6
  • High10
  • Medium22
  • Low0
Vulnerabilities per year
2018: 1 vulnerability1182023: 8 vulnerabilities8232024: 3 vulnerabilities3242025: 7 vulnerabilities7252026: 19 vulnerabilities1926

All JS Help Desk – AI-Powered Support & Ticketing System vulnerabilities

JS Help Desk – AI-Powered Support & Ticketing System vulnerabilities
SeverityVulnerabilityCVEPublished
Medium5.3Missing Authorization
≤5.0.3Update to 5.0.4
CVE-2026-119513
Medium6.4Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via 'jsticket_message' Ticket Field via VenoBox data-title
≤5.0.2Update to 5.0.3
CVE-2026-118046
Medium4.9Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'support_custom_img' Parameter
≤5.0.1Update to 5.0.2
CVE-2026-104739
Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
≤4.0.0Update to 5.0.0
CVE-2026-103079
Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
≤4.0.0Update to 5.0.0
CVE-2026-103078
Medium4.3Authenticated (Subscriber+) Information Exposure
<3.1.4Update to 3.1.4
CVE-2026-14928
Medium4.3Missing Authorization to Authenticated (Subscriber+) Ticket Reply Modification
≤3.1.3Update to 3.1.4
CVE-2026-14929
Medium4.3Insecure Direct Object Reference to Authenticated (Subscriber+) Cross-User Support Ticket Disclosure
≤3.1.4Update to 3.1.5
CVE-2026-15209
Medium5.3Unauthenticated Arbitrary Media Upload
<3.1.4Update to 3.1.4
CVE-2026-14930
Medium4.3Authenticated (Contributor+) User Email Disclosure
≤3.1.3Update to 3.1.4
CVE-2026-14931
Medium5.3Unauthenticated Insecure Direct Object Reference
≤3.1.0Update to 3.1.1
CVE-2026-57652
High8.8Authenticated (Subscriber+) Arbitrary File Deletion
≤3.1.1Update to 3.1.2
CVE-2026-56054
High7.5Unauthenticated SQL Injection
≤3.0.9Update to 3.1.0
CVE-2026-48886
Medium5.3Missing Authorization
≤3.0.9Update to 3.1.0
CVE-2026-48887
High7.5Unauthenticated SQL Injection via 'multiformid' Parameter
≤3.0.4Update to 3.0.5
CVE-2026-2511
Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
≤3.0.3Update to 3.0.4
CVE-2026-32535
Medium6.5Authenticated (Subscriber+) SQL Injection
≤3.0.3Update to 3.0.4
CVE-2026-32534
High7.5Unauthenticated SQL Injection via 'js-support-ticket-token-tkstatus' Cookie
≤2.8.2Update to 2.8.3
CVE-2023-7337
Medium6.5Authenticated (Subscriber+) SQL Injection
≤3.0.1Update to 3.0.2
CVE-2026-24959
Critical9.1Unauthenticated Arbitrary File Deletion
≤2.9.2Update to 2.9.3
CVE-2025-30878
Critical9.8Unauthenticated Local File Inclusion
≤2.9.2Update to 2.9.3
CVE-2025-30901
High7.5Unauthenticated SQL Injection
≤2.9.2Update to 2.9.3
CVE-2025-30886
High7.5Unauthenticated Arbitrary File Download
≤2.9.1Update to 2.9.2
CVE-2025-30882
Medium5.3Missing Authorization
≤2.9.2Update to 2.9.3
CVE-2025-30880
High7.5Unauthenticated Sensitive Information Exposure Through Unprotected Directory
≤2.8.8Update to 2.8.9
CVE-2024-13606
Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
≤2.8.8Update to 2.8.9
CVE-2024-13607
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤2.8.7Update to 2.8.8
CVE-2024-51670
Critical9.8Unauthenticated PHP Code Injection to Remote Code Execution
≤2.8.6Update to 2.8.7
CVE-2024-7094
Medium5.3Missing Authorization
≤2.8.3Update to 2.8.4
CVE-2024-31273
Critical9.8Unauthenticated SQL Injection via email and trackingid
<2.8.2Update to 2.8.2
CVE-2023-50839
High7.2Authenticated (Administrator+) Arbitrary File Upload
≤2.7.7Update to 2.7.8
CVE-2023-25444
Medium6.3Authenticated (Subscriber+) Insecure Direct Object Reference
≤2.7.7Update to 2.7.8
CVE-2023-23679
Medium5.4Cross-Site Request Forgery
≤2.7.1Update to 2.7.2
CVE-2022-46842
Medium6.3Missing Authorization
≤2.7.1Update to 2.7.2
CVE-2022-46840
Critical9.8Unauthenticated Arbitrary File Upload
≤2.7.1Update to 2.7.2
CVE-2022-46839
Critical9.1Missing Authorization to Plugin Settings Update
2.7.1 – 2.7.1Update to 2.7.2
CVE-2022-46838
High8.6Unauthenticated SQL Injection
≤2.7.1Update to 2.7.2
CVE-2022-47151
High8.8Cross-Site Request Forgery
≤2.0.5Update to 2.0.6
CVE-2018-21002

JS Help Desk – AI-Powered Support & Ticketing System: common questions

Does JS Help Desk – AI-Powered Support & Ticketing System have known vulnerabilities?

Yes. VulnCrest Radar lists 38 known vulnerabilities in JS Help Desk – AI-Powered Support & Ticketing System: 6 critical, 10 high, 22 medium. None are known to affect version null.

How do I check which version of JS Help Desk – AI-Powered Support & Ticketing System I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent JS Help Desk – AI-Powered Support & Ticketing System vulnerability?

CVE-2026-119513, published Nov 7, 2026: JS Help Desk – AI-Powered Support & Ticketing System <= 5.0.3 - Missing Authorization. Severity: Medium (CVSS 5.3).

Is any JS Help Desk – AI-Powered Support & Ticketing System vulnerability listed in CISA KEV?

No. None of the known JS Help Desk – AI-Powered Support & Ticketing System vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?