VulnTitan VulnTitan Security command center
Plugin Vulnerability Hub
Plugin 24 known issues Latest disclosed Mar 25, 2026

JS Help Desk – AI-Powered Support & Ticketing System Vulnerabilities

Review known vulnerability records for the WordPress plugin JS Help Desk – AI-Powered Support & Ticketing System (`js-support-ticket`), including severity, CVE references, affected versions, and patch status.

Recent tracked CVEs on this page include CVE-2026-2511, CVE-2026-32535 and CVE-2026-32534, so operators can jump from disclosure to patch validation without scanning the full feed first.

View on WordPress.org Back to Feed
Known Records
24
High or Critical
14
Patch Coverage
100%
Last Updated
Apr 02, 2026
Priority CVE Quick Links

Fast paths into JS Help Desk – AI-Powered Support & Ticketing System CVE reports

Start with the highest-signal CVE records for this WordPress plugin before scanning the full vulnerability feed.

Indexed CVEs
24
CVE-2025-30901 Critical 2.9.3
CVE-2025-30901 JS Help Desk – AI-Powered Support & Ticketing System Local File Inclusion

JS Help Desk <= 2.9.2 - Unauthenticated Local File Inclusion

CVE-2024-7094 Critical 2.8.7
CVE-2024-7094 JS Help Desk – AI-Powered Support & Ticketing System Remote Code Execution

JS Help Desk – The Ultimate Help Desk & Support Plugin <= 2.8.6 - Unauthenticated PHP Code Injection to Remote Code Execution

CVE-2023-50839 Critical 2.8.2
CVE-2023-50839 JS Help Desk – AI-Powered Support & Ticketing System SQL Injection

JS Help Desk <= 2.8.1 - Unauthenticated SQL Injection via email and trackingid

CVE-2022-46839 Critical 2.7.2
CVE-2022-46839 JS Help Desk – AI-Powered Support & Ticketing System Remote Code Execution

JS Help Desk <= 2.7.1 - Unauthenticated Arbitrary File Upload

CVE-2025-30878 Critical 2.9.3
CVE-2025-30878 JS Help Desk – AI-Powered Support & Ticketing System Remote Code Execution

JS Help Desk <= 2.9.2 - Unauthenticated Arbitrary File Deletion

CVE-2022-46838 Critical 2.7.2
CVE-2022-46838 JS Help Desk – AI-Powered Support & Ticketing System Authorization Bypass

JS Help Desk <= 2.7.1 - Missing Authorization to Plugin Settings Update

CVE-2018-21002 High 2.0.6
CVE-2018-21002 JS Help Desk – AI-Powered Support & Ticketing System Cross-Site Request Forgery

JS Help Desk – Best Help Desk & Support Plugin <= 2.0.5 - Cross-Site Request Forgery

CVE-2022-47151 High 2.7.2
CVE-2022-47151 JS Help Desk – AI-Powered Support & Ticketing System SQL Injection

JS Help Desk <= 2.7.1 - Unauthenticated SQL Injection

Coverage Snapshot

What this page helps you verify fast

This hub clusters every indexed record for JS Help Desk – AI-Powered Support & Ticketing System so operators can confirm whether a disclosed issue maps to the installed slug, version range, and patch path.

Patch Visibility
24 records include a published patch path, leaving 0 with no listed safe release yet.
Severity Mix
6 critical and 8 high severity findings.
Recent CVEs
CVE-2026-2511, CVE-2026-32535 and CVE-2026-32534
Reference Workflow
Jump from the hub into the full report when you need remediation notes, exploit context, CVSS vectors, or source references.
Triage First

Open the records most likely to drive action

These recent records surface the CVE strings, patch cues, and direct report links most operators need first.

Known Vulnerabilities

Reports for JS Help Desk – AI-Powered Support & Ticketing System

Sorted by latest disclosure date so newly published issues surface first.

Plugin High Patched: Yes CVE-2026-2511
CVE-2026-2511: JS Help Desk – AI-Powered Support & Ticketing System <= 3.0.4 - Unauthenticated SQL Injection via 'multiformid' Parameter

The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to SQL Injection via the `multiformid` parameter in the `storeTickets()` function in all versions up to, and including, 3.0.4. This is due to the user-supplied `multiformid` value being pa...

Published
Mar 25, 2026
Patched Release
3.0.5
Affected Versions
Versions up to 3.0.4
Next Step
Update to 3.0.5 or newer if supported.
Open CVE-2026-2511 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2026-32535
CVE-2026-32535: JS Help Desk – AI-Powered Support & Ticketing System <= 3.0.3 - Authenticated (Subscriber+) Insecure Direct Object Reference

The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.0.3 due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...

Published
Mar 23, 2026
Patched Release
3.0.4
Affected Versions
Versions up to 3.0.3
Next Step
Update to 3.0.4 or newer if supported.
Open CVE-2026-32535 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2026-32534
CVE-2026-32534: JS Help Desk – AI-Powered Support & Ticketing System <= 3.0.3 - Authenticated (Subscriber+) SQL Injection

The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 3.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This make...

Published
Mar 20, 2026
Patched Release
3.0.4
Affected Versions
Versions up to 3.0.3
Next Step
Update to 3.0.4 or newer if supported.
Open CVE-2026-32534 Report Open CVE Reference
Plugin High Patched: Yes CVE-2023-7337
CVE-2023-7337: JS Help Desk – AI-Powered Support & Ticketing System 2.8.2 - Unauthenticated SQL Injection via 'js-support-ticket-token-tkstatus' Cookie

The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to SQL Injection via the 'js-support-ticket-token-tkstatus' cookie in version 2.8.2 due to an incomplete fix for CVE-2023-50839 where a second sink was left with insufficient escaping on t...

Published
Mar 03, 2026
Patched Release
2.8.3
Affected Versions
Versions up to 2.8.2
Next Step
Update to 2.8.3 or newer if supported.
Open CVE-2023-7337 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2026-24959
CVE-2026-24959: JS Help Desk <= 3.0.1 - Authenticated (Subscriber+) SQL Injection

The JS Help Desk plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 3.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attacker...

Published
Feb 11, 2026
Patched Release
3.0.2
Affected Versions
Versions up to 3.0.1
Next Step
Update to 3.0.2 or newer if supported.
Open CVE-2026-24959 Report Open CVE Reference
Plugin Critical Patched: Yes CVE-2025-30901
CVE-2025-30901: JS Help Desk <= 2.9.2 - Unauthenticated Local File Inclusion

The JS Help Desk plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.9.2. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. T...

Published
Mar 27, 2025
Patched Release
2.9.3
Affected Versions
Versions up to 2.9.2
Next Step
Update to 2.9.3 or newer if supported.
Open CVE-2025-30901 Report Open CVE Reference
Plugin Critical Patched: Yes CVE-2025-30878
CVE-2025-30878: JS Help Desk <= 2.9.2 - Unauthenticated Arbitrary File Deletion

The JS Help Desk – The Ultimate Help Desk & Support Plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in a function in all versions up to, and including, 2.9.2. This makes it possible for unauthenticated attackers to del...

Published
Mar 27, 2025
Patched Release
2.9.3
Affected Versions
Versions up to 2.9.2
Next Step
Update to 2.9.3 or newer if supported.
Open CVE-2025-30878 Report Open CVE Reference
Plugin High Patched: Yes CVE-2025-30882
CVE-2025-30882: JS Help Desk <= 2.9.1 - Unauthenticated Arbitrary File Download

The JS Help Desk – The Ultimate Help Desk & Support Plugin plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.9.1. This makes it possible for unauthenticated attackers to downlod the contents of arbitrary files on the server, which can co...

Published
Mar 27, 2025
Patched Release
2.9.2
Affected Versions
Versions up to 2.9.1
Next Step
Update to 2.9.2 or newer if supported.
Open CVE-2025-30882 Report Open CVE Reference
Plugin High Patched: Yes CVE-2025-30886
CVE-2025-30886: JS Help Desk <= 2.9.2 - Unauthenticated SQL Injection

The JS Help Desk plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 2.9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attack...

Published
Mar 27, 2025
Patched Release
2.9.3
Affected Versions
Versions up to 2.9.2
Next Step
Update to 2.9.3 or newer if supported.
Open CVE-2025-30886 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-30880
CVE-2025-30880: JS Help Desk <= 2.9.2 - Missing Authorization

The JS Help Desk – The Ultimate Help Desk & Support Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.9.2. This makes it possible for unauthenticated attackers to perform an una...

Published
Mar 27, 2025
Patched Release
2.9.3
Affected Versions
Versions up to 2.9.2
Next Step
Update to 2.9.3 or newer if supported.
Open CVE-2025-30880 Report Open CVE Reference
Plugin High Patched: Yes CVE-2024-13606
CVE-2024-13606: JS Help Desk – The Ultimate Help Desk & Support Plugin <= 2.8.8 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory

The JS Help Desk – The Ultimate Help Desk & Support Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.8.8 via the 'jssupportticketdata' directory. This makes it possible for unauthenticated attackers to extract sen...

Published
Feb 12, 2025
Patched Release
2.8.9
Affected Versions
Versions up to 2.8.8
Next Step
Update to 2.8.9 or newer if supported.
Open CVE-2024-13606 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-13607
CVE-2024-13607: JS Help Desk – The Ultimate Help Desk & Support Plugin <= 2.8.8 - Authenticated (Subscriber+) Insecure Direct Object Reference

The JS Help Desk – The Ultimate Help Desk & Support Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.8.8 via the 'exportusereraserequest' due to missing validation on a user controlled key. This makes it possibl...

Published
Feb 03, 2025
Patched Release
2.8.9
Affected Versions
Versions up to 2.8.8
Next Step
Update to 2.8.9 or newer if supported.
Open CVE-2024-13607 Report Open CVE Reference