ELEX WordPress HelpDesk & Customer Ticketing System

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   ELEX WordPress HelpDesk & Customer Ticketing System

Information

Software Type Plugin
Software Slug elex-helpdesk-customer-support-ticket-system (view on wordpress.org)
Software Status Active
Software Author elextensions
Software Website elextensions.com
Software Downloads 24,351
Software Active Installs 300
Software Record Last Updated August 18, 2026

14 Vulnerabilities

Submit a Vulnerability
ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.6 - Authenticated (Subscriber+) SQL Injection
6.5
CVE-2026-48964
Jun 2, 2026
Researcher: Mukhlis Amien
ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.5 - Missing Authorization to Authenticated (Subscriber+) Settings Update
5.3
CVE-2025-14079
Feb 4, 2026
Researcher: Itthidej Aramsri (Boeing777)
ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.5 - Missing Authorization
4.3
CVE-2025-68837
Jan 27, 2026
Researcher: benzdeus
ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.4 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2025-9343
Dec 20, 2025
Researcher: Athiwat Tiprasaharn (Jitlada)
ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.2 - Authenticated (Contributor+) Privilege Escalation via eh_crm_edit_agent AJAX Action
6.3
CVE-2025-13534
Dec 1, 2025
Researcher: Athiwat Tiprasaharn (Jitlada)
ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Unauthenticated Arbitrary File Upload
9.8
CVE-2025-11456
Nov 20, 2025
Researcher: ifoundbug
ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Ticket Restore
4.3
CVE-2025-12023
Nov 20, 2025
Researcher: Athiwat Tiprasaharn (Jitlada)
ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Trash Empty
4.3
CVE-2025-12085
Nov 20, 2025
Researcher: Athiwat Tiprasaharn (Jitlada)
ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Trash Restore
4.3
CVE-2025-12022
Nov 20, 2025
Researcher: Athiwat Tiprasaharn (Jitlada)
ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.0 - Missing Authorization to Authenitcated (Subscriber+) to Scheduled Trigger Deletion
4.3
CVE-2025-12169
Nov 20, 2025
Researcher: Legion Hunter
ELEX WordPress HelpDesk & Customer Ticketing System <= 3.2.9 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'eh_crm_ticket_single_view_client'
4.3
CVE-2025-10039
Nov 20, 2025
Researcher: Athiwat Tiprasaharn (Jitlada)
ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Role Removal
4.3
CVE-2025-10054
Nov 20, 2025
Researcher: Michelle Porter
ELEX WordPress HelpDesk & Customer Ticketing System <= 3.2.9 - Authenticated (Subscriber+) Arbitrary File Upload
8.8
CVE-2025-47658
May 8, 2025
Researcher: Phat RiO
ELEX WordPress HelpDesk & Customer Ticketing System <= 3.2.6 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
8.8
CVE-2024-12171
Jan 31, 2025
Researcher: Thanh Nam Tran
Title Status CVE ID CVSS Researchers Date
ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.6 - Authenticated (Subscriber+) SQL Injection Patched CVE-2026-48964 6.5 Mukhlis Amien June 2, 2026
ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.5 - Missing Authorization to Authenticated (Subscriber+) Settings Update Patched CVE-2025-14079 5.3 Itthidej Aramsri (Boeing777) February 4, 2026
ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.5 - Missing Authorization Patched CVE-2025-68837 4.3 benzdeus January 27, 2026
ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.4 - Unauthenticated Stored Cross-Site Scripting Patched CVE-2025-9343 7.2 Athiwat Tiprasaharn (Jitlada) December 20, 2025
ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.2 - Authenticated (Contributor+) Privilege Escalation via eh_crm_edit_agent AJAX Action Patched CVE-2025-13534 6.3 Athiwat Tiprasaharn (Jitlada) December 1, 2025
ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Unauthenticated Arbitrary File Upload Patched CVE-2025-11456 9.8 ifoundbug November 20, 2025
ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Ticket Restore Patched CVE-2025-12023 4.3 Athiwat Tiprasaharn (Jitlada) November 20, 2025
ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Trash Empty Patched CVE-2025-12085 4.3 Athiwat Tiprasaharn (Jitlada) November 20, 2025
ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Trash Restore Patched CVE-2025-12022 4.3 Athiwat Tiprasaharn (Jitlada) November 20, 2025
ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.0 - Missing Authorization to Authenitcated (Subscriber+) to Scheduled Trigger Deletion Patched CVE-2025-12169 4.3 Legion Hunter November 20, 2025
ELEX WordPress HelpDesk & Customer Ticketing System <= 3.2.9 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'eh_crm_ticket_single_view_client' Patched CVE-2025-10039 4.3 Athiwat Tiprasaharn (Jitlada) November 20, 2025
ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Role Removal Patched CVE-2025-10054 4.3 Michelle Porter November 20, 2025
ELEX WordPress HelpDesk & Customer Ticketing System <= 3.2.9 - Authenticated (Subscriber+) Arbitrary File Upload Patched CVE-2025-47658 8.8 Phat RiO May 8, 2025
ELEX WordPress HelpDesk & Customer Ticketing System <= 3.2.6 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation Patched CVE-2024-12171 8.8 Thanh Nam Tran January 31, 2025

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation