WordPress plugin
Customer Support Ticket System & Helpdesk security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical1
- High3
- Medium5
- Low0
All Customer Support Ticket System & Helpdesk vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Critical9.8 | Unauthenticated Code Injection via 'path' Parameter ≤6.0.5Update to 6.0.6 | CVE-2026-15011 | |
| High7.5 | Unauthenticated SQL Injection via WordPress Search 's' Parameter ≤6.0.4Update to 6.0.5 | CVE-2026-9848 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting ≤6.0.2Update to 6.0.3 | CVE-2025-60157 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting ≤2.5.0Update to 2.5.1 | CVE-2025-58915 | |
| High8.1 | Unauthenticated PHP Object Injection ≤6.0.2Update to 6.0.3 | CVE-2025-53584 | |
| High8.1 | Unauthenticated Limited Remote Code Execution ≤2.5.2Update to 2.5.3 | CVE-2025-8420 | |
| Medium4.4 | Authenticated (Administrator+) Stored Cross-Site Scripting <5.13Update to 5.13 | — | |
| Medium5.5 | Authenticated (Admin+) Stored Cross-Site Scripting <5.10.4Update to 5.10.4 | CVE-2021-24622 | |
| Medium6.1 | Reflected Cross-Site Scripting ≤5.5.1Update to 5.6.0 | — |
- Critical9.8Unauthenticated Code Injection via 'path' Parameter
≤6.0.5Update to 6.0.6
- High7.5Unauthenticated SQL Injection via WordPress Search 's' Parameter
≤6.0.4Update to 6.0.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤6.0.2Update to 6.0.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.5.0Update to 2.5.1
- High8.1Unauthenticated PHP Object Injection
≤6.0.2Update to 6.0.3
- High8.1Unauthenticated Limited Remote Code Execution
≤2.5.2Update to 2.5.3
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
<5.13Update to 5.13
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
<5.10.4Update to 5.10.4
- Medium6.1Reflected Cross-Site Scripting
≤5.5.1Update to 5.6.0
Customer Support Ticket System & Helpdesk: common questions
Does Customer Support Ticket System & Helpdesk have known vulnerabilities?
Yes. VulnCrest Radar lists 9 known vulnerabilities in Customer Support Ticket System & Helpdesk: 1 critical, 3 high, 5 medium. At least one is not fixed in the latest version.
How do I check which version of Customer Support Ticket System & Helpdesk I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Customer Support Ticket System & Helpdesk vulnerability?
CVE-2026-15011, published Jul 22, 2026: Customer Support Ticket System & Helpdesk <= 6.0.5 - Unauthenticated Code Injection via 'path' Parameter. Severity: Critical (CVSS 9.8).
Is any Customer Support Ticket System & Helpdesk vulnerability listed in CISA KEV?
No. None of the known Customer Support Ticket System & Helpdesk vulnerabilities is currently listed in the CISA KEV catalog.