JS Help Desk – AI-Powered Support & Ticketing System

Software Type	Plugin
Software Slug	js-support-ticket (view on wordpress.org)
Software Status	Active
Software Author	rabilal
Software Website	www.jshelpdesk.com
Software Downloads	655,908
Software Active Installs	7,000
Software Record Last Updated	July 22, 2026

Showing 1-20 of 28 Vulnerabilities

Submit a Vulnerability

JS Help Desk – AI-Powered Support & Ticketing System <= 3.1.0 - Unauthenticated Insecure Direct Object Reference

5.3

CVE-2026-57652

Jun 26, 2026

Researcher: William Matos

JS Help Desk – AI-Powered Support & Ticketing System <= 3.1.1 - Authenticated (Subscriber+) Arbitrary File Deletion

8.8

CVE-2026-56054

Jun 25, 2026

Researcher: daroo

JS Help Desk – AI-Powered Support & Ticketing System <= 3.0.9 - Unauthenticated SQL Injection

7.5

CVE-2026-48886

Jun 2, 2026

Researcher: sequence_X0

JS Help Desk – AI-Powered Support & Ticketing System <= 3.0.9 - Missing Authorization

5.3

CVE-2026-48887

Jun 2, 2026

Researcher: Nvz

JS Help Desk – AI-Powered Support & Ticketing System <= 3.0.4 - Unauthenticated SQL Injection via 'multiformid' Parameter

7.5

CVE-2026-2511

Mar 25, 2026

Researcher: Nabil Irawan

JS Help Desk – AI-Powered Support & Ticketing System <= 3.0.3 - Authenticated (Subscriber+) Insecure Direct Object Reference

4.3

CVE-2026-32535

Mar 23, 2026

Researcher: Bonds

JS Help Desk – AI-Powered Support & Ticketing System <= 3.0.3 - Authenticated (Subscriber+) SQL Injection

6.5

CVE-2026-32534

Mar 20, 2026

Researcher: Bonds

JS Help Desk – AI-Powered Support & Ticketing System 2.8.2 - Unauthenticated SQL Injection via 'js-support-ticket-token-tkstatus' Cookie

7.5

CVE-2023-7337

Mar 3, 2026

Researchers:

JS Help Desk <= 3.0.1 - Authenticated (Subscriber+) SQL Injection

6.5

CVE-2026-24959

Feb 11, 2026

Researcher: Bonds

JS Help Desk <= 2.9.2 - Missing Authorization

5.3

CVE-2025-30880

Mar 27, 2025

Researcher: LVT-tholv2k

JS Help Desk <= 2.9.2 - Unauthenticated Local File Inclusion

9.8

CVE-2025-30901

Mar 27, 2025

Researcher: Trương Hữu Phúc (truonghuuphuc)

JS Help Desk <= 2.9.2 - Unauthenticated Arbitrary File Deletion

9.1

CVE-2025-30878

Mar 27, 2025

Researcher: LVT-tholv2k

JS Help Desk <= 2.9.1 - Unauthenticated Arbitrary File Download

7.5

CVE-2025-30882

Mar 27, 2025

Researcher: LVT-tholv2k

JS Help Desk <= 2.9.2 - Unauthenticated SQL Injection

7.5

CVE-2025-30886

Mar 27, 2025

Researcher: LVT-tholv2k

JS Help Desk – The Ultimate Help Desk & Support Plugin <= 2.8.8 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory

7.5

CVE-2024-13606

Feb 12, 2025

Researcher: Tim Coen

JS Help Desk – The Ultimate Help Desk & Support Plugin <= 2.8.8 - Authenticated (Subscriber+) Insecure Direct Object Reference

4.3

CVE-2024-13607

Feb 3, 2025

Researcher: Tim Coen

JS Help Desk – Best Help Desk & Support Plugin <= 2.8.7 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVE-2024-51670

Nov 1, 2024

Researcher: casol

JS Help Desk – The Ultimate Help Desk & Support Plugin <= 2.8.6 - Unauthenticated PHP Code Injection to Remote Code Execution

9.8

CVE-2024-7094

Aug 12, 2024

Researcher: Connor Billings

JS Help Desk – Best Help Desk & Support Plugin <= 2.8.3 - Missing Authorization

5.3

CVE-2024-31273

Apr 5, 2024

Researcher: Fariq Fadillah Gusti Insani (fariqfgi)

JS Help Desk <= 2.8.1 - Unauthenticated SQL Injection via email and trackingid

9.8

CVE-2023-50839

Dec 21, 2023

Researcher: Fariq Fadillah Gusti Insani (fariqfgi)

Title	Status	CVE ID	CVSS	Researchers	Date
JS Help Desk – AI-Powered Support & Ticketing System <= 3.1.0 - Unauthenticated Insecure Direct Object Reference	Patched	CVE-2026-57652	5.3	William Matos	June 26, 2026
JS Help Desk – AI-Powered Support & Ticketing System <= 3.1.1 - Authenticated (Subscriber+) Arbitrary File Deletion	Patched	CVE-2026-56054	8.8	daroo	June 25, 2026
JS Help Desk – AI-Powered Support & Ticketing System <= 3.0.9 - Unauthenticated SQL Injection	Patched	CVE-2026-48886	7.5	sequence_X0	June 2, 2026
JS Help Desk – AI-Powered Support & Ticketing System <= 3.0.9 - Missing Authorization	Patched	CVE-2026-48887	5.3	Nvz	June 2, 2026
JS Help Desk – AI-Powered Support & Ticketing System <= 3.0.4 - Unauthenticated SQL Injection via 'multiformid' Parameter	Patched	CVE-2026-2511	7.5	Nabil Irawan	March 25, 2026
JS Help Desk – AI-Powered Support & Ticketing System <= 3.0.3 - Authenticated (Subscriber+) Insecure Direct Object Reference	Patched	CVE-2026-32535	4.3	Bonds	March 23, 2026
JS Help Desk – AI-Powered Support & Ticketing System <= 3.0.3 - Authenticated (Subscriber+) SQL Injection	Patched	CVE-2026-32534	6.5	Bonds	March 20, 2026
JS Help Desk – AI-Powered Support & Ticketing System 2.8.2 - Unauthenticated SQL Injection via 'js-support-ticket-token-tkstatus' Cookie	Patched	CVE-2023-7337	7.5		March 3, 2026
JS Help Desk <= 3.0.1 - Authenticated (Subscriber+) SQL Injection	Patched	CVE-2026-24959	6.5	Bonds	February 11, 2026
JS Help Desk <= 2.9.2 - Missing Authorization	Patched	CVE-2025-30880	5.3	LVT-tholv2k	March 27, 2025
JS Help Desk <= 2.9.2 - Unauthenticated Local File Inclusion	Patched	CVE-2025-30901	9.8	Trương Hữu Phúc (truonghuuphuc)	March 27, 2025
JS Help Desk <= 2.9.2 - Unauthenticated Arbitrary File Deletion	Patched	CVE-2025-30878	9.1	LVT-tholv2k	March 27, 2025
JS Help Desk <= 2.9.1 - Unauthenticated Arbitrary File Download	Patched	CVE-2025-30882	7.5	LVT-tholv2k	March 27, 2025
JS Help Desk <= 2.9.2 - Unauthenticated SQL Injection	Patched	CVE-2025-30886	7.5	LVT-tholv2k	March 27, 2025
JS Help Desk – The Ultimate Help Desk & Support Plugin <= 2.8.8 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory	Patched	CVE-2024-13606	7.5	Tim Coen	February 12, 2025
JS Help Desk – The Ultimate Help Desk & Support Plugin <= 2.8.8 - Authenticated (Subscriber+) Insecure Direct Object Reference	Patched	CVE-2024-13607	4.3	Tim Coen	February 3, 2025
JS Help Desk – Best Help Desk & Support Plugin <= 2.8.7 - Authenticated (Administrator+) Stored Cross-Site Scripting	Patched	CVE-2024-51670	4.4	casol	November 1, 2024
JS Help Desk – The Ultimate Help Desk & Support Plugin <= 2.8.6 - Unauthenticated PHP Code Injection to Remote Code Execution	Patched	CVE-2024-7094	9.8	Connor Billings	August 12, 2024
JS Help Desk – Best Help Desk & Support Plugin <= 2.8.3 - Missing Authorization	Patched	CVE-2024-31273	5.3	Fariq Fadillah Gusti Insani (fariqfgi)	April 5, 2024
JS Help Desk <= 2.8.1 - Unauthenticated SQL Injection via email and trackingid	Patched	CVE-2023-50839	9.8	Fariq Fadillah Gusti Insani (fariqfgi)	December 21, 2023

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation