SecAlerts
J

JS Help Desk

Security Risk Profile

43
/100
medium

Security Risk Score

Comprehensive risk assessment based on 13 vulnerabilities, EPSS scores, exploitation status, and remediation availability.

📅 Data spans from April 17, 2024 to present

13
Total CVEs
8
Critical+High
0
Exploited
4
Unpatched

Threat Assessment

Avg CVSS
7.5
Base severity
Avg EPSS
0%
Exploit probability
Unpatched
4
Critical/High
Risk Level
43/100
medium
🆕 1Fresh (<7d)📈 1 in Last 30 Days

Severity Distribution

Critical
4
High
4
Medium
5
Low
0

Exploit Likelihood

>50% chance
0
20-50%
0
5-20%
0
<5%
0

Age Distribution

Common Weaknesses (CWE)

1
SQL Injection
3
2
XSS
2
3
Infoleak
1
4
Malicious File Upload
1

Most Affected Products

1. joomsky Js Help Desk Wordpress6
2. JS Help Desk JS Help Desk4
3. JS Help Desk JS Help Desk – Best Help Desk & Support Plugin3
4. WordPress JS Help Desk3
5. JS Help Desk JS Help Desk – AI-Powered Support & Ticketing System2

Recent Vulnerabilities

See more →
CVE-2026-118046
CVSS 6.4medium

JS Help Desk <= 5.0.2 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via 'jsticket_message' Ticket Field via VenoBox data-title

Nov 7, 2026🔧 No Patch
CVE-2026-15209
CVSS 6.5medium

JS Help Desk – AI-Powered Support & Ticketing System < 3.1.5 - Subscriber+ Cross-User Support Ticket Disclosure via IDOR

Jul 31, 2026🔧 No Patch
CVE-2026-14930
CVSS 7.5high

JS Help Desk < 3.1.4 - Unauthenticated Arbitrary Ticket File Attachment Upload

Jul 31, 2026🔧 No Patch
CVE-2026-48886
CVSS 9.3critical

WordPress JS Help Desk plugin <= 3.0.9 - SQL Injection vulnerability

Jun 15, 2026🔧 No Patch
CVE-2026-2511
CVSS 7.5high

JS Help Desk – AI-Powered Support & Ticketing System <= 3.0.4 - Unauthenticated SQL Injection via 'multiformid' Parameter

Mar 26, 2026🔧 No Patch
CVE-2024-13606
CVSS 7.5high

JS Help Desk – The Ultimate Help Desk & Support Plugin <= 2.8.8 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory

Feb 13, 2025🔧 No Patch
CVE-2024-13607
CVSS 4.3medium

JS Help Desk – The Ultimate Help Desk & Support Plugin <= 2.8.8 - Authenticated (Subscriber+) Insecure Direct Object Reference

Feb 4, 2025🔧 No Patch
CVE-2022-46838
CVSS 9.1critical

WordPress JS Help Desk plugin <= 2.7.1 - Unauthenticated Settings Change Vulnerability

Dec 13, 2024
CVE-2022-46840
CVSS 5.4medium

WordPress JS Help Desk plugin <= 2.7.1 - Broken Access Control

Dec 13, 2024
CVE-2024-51670
CVSS 5.9medium

WordPress JS Help Desk plugin <= 2.8.7 - Stored Cross Site Scripting (XSS) vulnerability

Nov 9, 2024

Monitor JS Help Desk in Real-Time

Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.

Powered bySecAlerts

Monitor Your Software Stack in Real-Time

Get instant alerts when vulnerabilities are discovered in your software stack. Stay ahead of security threats with SecAlerts.

© 2026 SecAlerts Pty Ltd. All rights reserved.