VulnTitan VulnTitan Security command center
Plugin Vulnerability Hub
Plugin 14 known issues Latest disclosed Jun 02, 2026

ELEX WordPress HelpDesk & Customer Ticketing System Vulnerabilities

Review known vulnerability records for the WordPress plugin ELEX WordPress HelpDesk & Customer Ticketing System (`elex-helpdesk-customer-support-ticket-system`), including severity, CVE references, affected versions, and patch status.

Recent tracked CVEs on this page include CVE-2026-48964, CVE-2025-14079 and CVE-2025-68837, so operators can jump from disclosure to patch validation without scanning the full feed first.

View on WordPress.org Back to Feed
Known Records
14
High or Critical
4
Patch Coverage
100%
Last Updated
Jun 08, 2026
Related Security Guides

Use these guides while reviewing ELEX WordPress HelpDesk & Customer Ticketing System fixes

Pair this plugin vulnerability hub with practical WordPress hardening, scanner, and patch workflow guidance.

Hardening
WordPress hardening checklist for exposed plugins

Review patch cadence, privileged access, XML-RPC exposure, backups, and monitoring controls.
Plugin Security
WordPress plugin security basics for patch decisions

Use ownership, update testing, least privilege, and removal criteria to reduce plugin risk.
Scanning
WordPress vulnerability scanner buyer's guide

Compare scanner coverage for plugin CVEs, version detection, alert noise, and remediation workflow.
Patch Decision Workflow

How to prioritize ELEX WordPress HelpDesk & Customer Ticketing System remediation

Use the hub as a decision layer before opening individual records: confirm whether the issue has a CVE, whether a fixed version exists, and whether the affected range overlaps production installs.

Search-Ready Records
14
1. Match the Package
Confirm the installed WordPress plugin slug is elex-helpdesk-customer-support-ticket-system before acting on any CVE from this cluster.
2. Sort by Severity
Start with 4 high or critical records, then review medium and unrated findings with public references.
3. Check Patch Evidence
14 records include a patch path; verify compatibility before closing the finding.
4. Monitor Gaps
0 records still lack a listed fixed release, so keep this hub in the review queue.
High-Signal Remediation Targets
CVE-2025-11456 Critical
Remote Code Execution remediation for ELEX WordPress HelpDesk & Customer Ticketing System

Affected range: Versions up to 3.3.1. Fixed version: 3.3.2.

CVE-2025-47658 High
Remote Code Execution remediation for ELEX WordPress HelpDesk & Customer Ticketing System

Affected range: Versions up to 3.2.9. Fixed version: 3.3.0.

CVE-2024-12171 High
Privilege Escalation remediation for ELEX WordPress HelpDesk & Customer Ticketing System

Affected range: Versions up to 3.2.6. Fixed version: 3.2.7.

CVE-2025-9343 High
Stored Cross-Site Scripting remediation for ELEX WordPress HelpDesk & Customer Ticketing System

Affected range: Versions up to 3.3.4. Fixed version: 3.3.5.

Priority CVE Quick Links

Fast paths into ELEX WordPress HelpDesk & Customer Ticketing System CVE reports

Start with the highest-signal CVE records for this WordPress plugin before scanning the full vulnerability feed.

Indexed CVEs
14
Tracked CVE Issue Type Affected Versions Fixed Version CVSS
CVE-2025-11456
ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Unauthenticated Arbit...
 Remote Code Execution Versions up to 3.3.1 3.3.2 CVSS 9.8
CVE-2025-47658
ELEX WordPress HelpDesk & Customer Ticketing System <= 3.2.9 - Authenticated (Subscr...
 Remote Code Execution Versions up to 3.2.9 3.3.0 CVSS 8.8
CVE-2024-12171
ELEX WordPress HelpDesk & Customer Ticketing System <= 3.2.6 - Missing Authorization...
 Privilege Escalation Versions up to 3.2.6 3.2.7 CVSS 8.8
CVE-2025-9343
ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.4 - Unauthenticated Store...
 Stored Cross-Site Scripting Versions up to 3.3.4 3.3.5 CVSS 7.2
CVE-2026-48964
ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.6 - Authenticated (Subscr...
 SQL Injection Versions up to 3.3.6 3.3.7 CVSS 6.5
CVE-2025-13534
ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.2 - Authenticated (Contri...
 Privilege Escalation Versions up to 3.3.2 3.3.3 CVSS 6.3
CVE-2025-14079
ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.5 - Missing Authorization...
 Vulnerability Versions up to 3.3.5 3.3.6 CVSS 5.3
CVE-2025-68837
ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.5 - Missing Authorization
 Vulnerability Versions up to 3.3.5 3.3.6 CVSS 4.3
CVE-2025-11456 Critical 3.3.2
CVE-2025-11456 ELEX WordPress HelpDesk & Customer Ticketing System Remote Code Execution

ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Unauthenticated Arbitrary File Upload

CVE-2025-47658 High 3.3.0
CVE-2025-47658 ELEX WordPress HelpDesk & Customer Ticketing System Remote Code Execution

ELEX WordPress HelpDesk & Customer Ticketing System <= 3.2.9 - Authenticated (Subscriber+) Arbitrary File Upload

CVE-2024-12171 High 3.2.7
CVE-2024-12171 ELEX WordPress HelpDesk & Customer Ticketing System Privilege Escalation

ELEX WordPress HelpDesk & Customer Ticketing System <= 3.2.6 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation

CVE-2025-9343 High 3.3.5
CVE-2025-9343 ELEX WordPress HelpDesk & Customer Ticketing System Stored Cross-Site Scripting

ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.4 - Unauthenticated Stored Cross-Site Scripting

CVE-2026-48964 Medium 3.3.7
CVE-2026-48964 ELEX WordPress HelpDesk & Customer Ticketing System SQL Injection

ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.6 - Authenticated (Subscriber+) SQL Injection

CVE-2025-13534 Medium 3.3.3
CVE-2025-13534 ELEX WordPress HelpDesk & Customer Ticketing System Privilege Escalation

ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.2 - Authenticated (Contributor+) Privilege Escalation via eh_crm_edit_agent AJAX Action

CVE-2025-14079 Medium 3.3.6
CVE-2025-14079 ELEX WordPress HelpDesk & Customer Ticketing System Vulnerability

ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.5 - Missing Authorization to Authenticated (Subscriber+) Settings Update

CVE-2025-68837 Medium 3.3.6
CVE-2025-68837 ELEX WordPress HelpDesk & Customer Ticketing System Vulnerability

ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.5 - Missing Authorization

Coverage Snapshot

What this page helps you verify fast

This hub clusters tracked records for ELEX WordPress HelpDesk & Customer Ticketing System so operators can confirm whether a disclosed issue maps to the installed slug, version range, and patch path.

Patch Visibility
14 records include a published patch path, leaving 0 with no listed safe release yet.
Severity Mix
1 critical and 3 high severity findings.
Recent CVEs
CVE-2026-48964, CVE-2025-14079 and CVE-2025-68837
Reference Workflow
Jump from the hub into the full report when you need remediation notes, exploit context, CVSS vectors, or source references.
Triage First

Open the records most likely to drive action

These recent records surface the CVE strings, patch cues, and direct report links most operators need first.

Known Vulnerabilities

Reports for ELEX WordPress HelpDesk & Customer Ticketing System

Sorted by latest disclosure date so newly published issues surface first.

Plugin Medium Patched: Yes CVE-2026-48964
CVE-2026-48964: ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.6 - Authenticated (Subscriber+) SQL Injection

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 3.3.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes...

Published
Jun 02, 2026
Patched Release
3.3.7
Affected Versions
Versions up to 3.3.6
Next Step
Update to 3.3.7 or newer if supported.
Review CVE-2026-48964 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-14079
CVE-2025-14079: ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.5 - Missing Authorization to Authenticated (Subscriber+) Settings Update

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.3.5. This is due to missing capability checks on the eh_crm_ticket_general function combined with a shared nonce that is exp...

Published
Feb 04, 2026
Patched Release
3.3.6
Affected Versions
Versions up to 3.3.5
Next Step
Update to 3.3.6 or newer if supported.
Review CVE-2025-14079 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-68837
CVE-2025-68837: ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.5 - Missing Authorization

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 3.3.5. This makes it possible for authenticated attackers, with Subscriber-level...

Published
Jan 27, 2026
Patched Release
3.3.6
Affected Versions
Versions up to 3.3.5
Next Step
Update to 3.3.6 or newer if supported.
Review CVE-2025-68837 fixed version details Open CVE Reference
Plugin High Patched: Yes CVE-2025-9343
CVE-2025-9343: ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.4 - Unauthenticated Stored Cross-Site Scripting

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via ticket subjects in all versions up to, and including, 3.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthe...

Published
Dec 20, 2025
Patched Release
3.3.5
Affected Versions
Versions up to 3.3.4
Next Step
Update to 3.3.5 or newer if supported.
Review CVE-2025-9343 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-13534
CVE-2025-13534: ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.2 - Authenticated (Contributor+) Privilege Escalation via eh_crm_edit_agent AJAX Action

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.3.2. This is due to missing authorization checks on the eh_crm_edit_agent AJAX action. This makes it possible for authenticat...

Published
Dec 01, 2025
Patched Release
3.3.3
Affected Versions
Versions up to 3.3.2
Next Step
Update to 3.3.3 or newer if supported.
Review CVE-2025-13534 fixed version details Open CVE Reference
Plugin Critical Patched: Yes CVE-2025-11456
CVE-2025-11456: ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Unauthenticated Arbitrary File Upload

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the eh_crm_new_ticket_post() function in all versions up to, and including, 3.3.1. This makes it possible for unauthenticate...

Published
Nov 20, 2025
Patched Release
3.3.2
Affected Versions
Versions up to 3.3.1
Next Step
Update to 3.3.2 or newer if supported.
Review CVE-2025-11456 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-12023
CVE-2025-12023: ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Ticket Restore

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the eh_crm_restore_data() function in all versions up to, and including, 3.3.1. This makes it possible for authenti...

Published
Nov 20, 2025
Patched Release
3.3.2
Affected Versions
Versions up to 3.3.1
Next Step
Update to 3.3.2 or newer if supported.
Review CVE-2025-12023 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-12085
CVE-2025-12085: ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Trash Empty

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'eh_crm_settings_empty_trash' function in all versions up to, and including, 3.3.1. This makes it possible for...

Published
Nov 20, 2025
Patched Release
3.3.2
Affected Versions
Versions up to 3.3.1
Next Step
Update to 3.3.2 or newer if supported.
Review CVE-2025-12085 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-12022
CVE-2025-12022: ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Trash Restore

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'eh_crm_settings_restore_trash' AJAX endpoint in all versions up to, and including, 3.3.1. This makes it possib...

Published
Nov 20, 2025
Patched Release
3.3.2
Affected Versions
Versions up to 3.3.1
Next Step
Update to 3.3.2 or newer if supported.
Review CVE-2025-12022 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-12169
CVE-2025-12169: ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.0 - Missing Authorization to Authenitcated (Subscriber+) to Scheduled Trigger Deletion

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_eh_crm_settings_empty_scheduled_actions' AJAX Action in all versions up to, and including, 3.3.0. This...

Published
Nov 20, 2025
Patched Release
3.3.1
Affected Versions
Versions up to 3.3.0
Next Step
Update to 3.3.1 or newer if supported.
Review CVE-2025-12169 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-10054
CVE-2025-10054: ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Role Removal

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'eh_crm_remove_agent' function in all versions up to, and including, 3.3.1. This makes it possible for authenti...

Published
Nov 20, 2025
Patched Release
3.3.2
Affected Versions
Versions up to 3.3.1
Next Step
Update to 3.3.2 or newer if supported.
Review CVE-2025-10054 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-10039
CVE-2025-10039: ELEX WordPress HelpDesk & Customer Ticketing System <= 3.2.9 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'eh_crm_ticket_single_view_client'

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.2.9 via the 'eh_crm_ticket_single_view_client' due to missing validation on a user controlled key. This makes it...

Published
Nov 20, 2025
Patched Release
3.3.0
Affected Versions
Versions up to 3.2.9
Next Step
Update to 3.3.0 or newer if supported.
Review CVE-2025-10039 fixed version details Open CVE Reference