JoomSky JS Help Desk vulnerabilities

Latest JoomSky JS Help Desk CVEs

Newest publication first

1. CVE-2026-57652 WordPress JS Help Desk plugin <= 3.1.0 - Insecure Direct Object References (IDOR) vulnerability

   Published 2026-06-26

   Medium·CVSS 5.3 EPSS 0.31%

   Unauthenticated Insecure Direct Object References (IDOR) in JS Help Desk <= 3.1.0 versions.

2. CVE-2026-32535 WordPress JS Help Desk plugin <= 3.0.3 - Insecure Direct Object References (IDOR) vulnerability

   Published 2026-03-25

   Medium·CVSS 6.5 EPSS 0.17%

   Authorization Bypass Through User-Controlled Key vulnerability in JoomSky JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through <= 3.0.3.

3. CVE-2026-32534 WordPress JS Help Desk plugin <= 3.0.3 - SQL Injection vulnerability

   Published 2026-03-25

   High·CVSS 8.5 EPSS 0.23%

   Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JoomSky JS Help Desk js-support-ticket allows Blind SQL Injection.This issue affects JS Help Desk: from n/a through <= 3.0.3.

4. CVE-2026-24959 WordPress JS Help Desk plugin <= 3.0.1 - SQL Injection vulnerability

   Published 2026-02-20

   High·CVSS 8.5 EPSS 0.25%

   Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JoomSky JS Help Desk js-support-ticket allows Blind SQL Injection.This issue affects JS Help Desk: from n/a through <= 3.0.1.

5. CVE-2025-30901 WordPress JS Help Desk plugin <= 2.9.2 - Local File Inclusion vulnerability

   Published 2025-04-01

   High·CVSS 8.1 EPSS 0.89%

   Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in JoomSky JS Help Desk js-support-ticket allows PHP Local File Inclusion.This issue affects JS Help Desk: from n/a through <= 2.9.2.

6. CVE-2025-30886 WordPress JS Help Desk plugin <= 2.9.2 - SQL Injection vulnerability

   Published 2025-04-01

   Critical·CVSS 10.0 EPSS 0.54%

   Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JoomSky JS Help Desk js-support-ticket allows SQL Injection.This issue affects JS Help Desk: from n/a through <= 2.9.2.

7. CVE-2025-30882 WordPress JS Help Desk plugin <= 2.9.1 - Arbitrary File Download vulnerability

   Published 2025-04-01

   High·CVSS 7.5 EPSS 0.61%

   Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in JoomSky JS Help Desk js-support-ticket allows Path Traversal.This issue affects JS Help Desk: from n/a through <= 2.9.1.

8. CVE-2025-30878 WordPress JS Help Desk plugin <= 2.9.2 - Arbitrary File Deletion vulnerability

   Published 2025-04-01

   Critical·CVSS 9.1 EPSS 0.65%

   Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in JoomSky JS Help Desk js-support-ticket allows Path Traversal.This issue affects JS Help Desk: from n/a through <= 2.9.2.

9. CVE-2025-30880 WordPress JS Help Desk plugin <= 2.9.2 - Broken Access Control vulnerability

   Published 2025-04-01

   High·CVSS 7.5 EPSS 0.51%

   Missing Authorization vulnerability in JoomSky JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through <= 2.9.2.

10. CVE-2022-46838 WordPress JS Help Desk plugin <= 2.7.1 - Unauthenticated Settings Change Vulnerability

    Published 2024-12-13

    Critical·CVSS 9.1 EPSS 0.73%

    Missing Authorization vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.7.1.

11. CVE-2022-46840 WordPress JS Help Desk plugin <= 2.7.1 - Broken Access Control

    Published 2024-12-13

    Medium·CVSS 5.4 EPSS 0.45%

    Missing Authorization vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.7.1.

12. CVE-2024-51670 WordPress JS Help Desk plugin <= 2.8.7 - Stored Cross Site Scripting (XSS) vulnerability

    Published 2024-11-09

    Medium·CVSS 4.8 EPSS 0.28%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JoomSky JS Help Desk js-support-ticket allows Stored XSS.This issue affects JS Help Desk: from n/a through <= 2.8.7.

13. CVE-2024-43274 WordPress JS Help Desk – The Ultimate Help Desk plugin <= 2.8.6 - Broken Access Control vulnerability

    Published 2024-11-01

    Critical·CVSS 9.8 EPSS 0.44%

    Missing Authorization vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.8.6.

14. CVE-2023-25444 WordPress JS Help Desk – Best Help Desk & Support Plugin plugin <= 2.7.7 - Arbitrary File Upload vulnerability

    Published 2024-05-17

    Critical·CVSS 9.1 EPSS 0.84%

    Unrestricted Upload of File with Dangerous Type vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin allows Using Malicious Files.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.7.7.

15. CVE-2022-47151 WordPress JS Help Desk plugin <= 2.7.1 - Unauth. SQL Injection Vulnerability

    Published 2024-04-17

    High·CVSS 8.6 EPSS 0.44%

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.7.1.

16. CVE-2018-21002 JS Help Desk – Best Help Desk & Support Plugin <= 2.0.5 - Cross-Site Request Forgery

    Published 2019-08-27

    High·CVSS 8.8 EPSS 0.68%

    The js-support-ticket plugin before 2.0.6 for WordPress has CSRF.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.