188 matches found
CVE-2026-14931
The JS Help Desk WordPress plugin before 3.1.4 grants a support-agent capability to the Contributor role on activation and does not perform a capability check on a user-listing handler, allowing Contributor-level users to enumerate the email addresses of all registered WordPress users...
CVE-2026-14931 JS Help Desk < 3.1.4 - Contributor+ User Email Disclosure
The JS Help Desk WordPress plugin before 3.1.4 grants a support-agent capability to the Contributor role on activation and does not perform a capability check on a user-listing handler, allowing Contributor-level users to enumerate the email addresses of all registered WordPress users...
CVE-2026-14928 JS Help Desk < 3.1.4 - Subscriber+ Sensitive Information Disclosure via checkAIReplyTicketsBySubject
The JS Help Desk WordPress plugin before 3.1.4 does not perform authorization or ownership checks before returning support-ticket content in a nonce-gated search handler, allowing any authenticated user Subscriber and above to read the subject and full message body of every other user's support...
CVE-2026-14929
The JS Help Desk WordPress plugin, in versions prior to 3.1.4 , is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The plugin fails to verify ownership of a targeted reply before allowing it to be updated. This allows any authenticated user with Subscriber privileges or higher to o...
CVE-2026-14928
The JS Help Desk WordPress plugin, in versions before 3.1.4 , contains a sensitive information disclosure vulnerability. The root cause is a failure to perform adequate authorization or ownership checks within a nonce-gated search handler (specifically identified in some records as checkAIReplyTi...
CVE-2026-14928
The JS Help Desk WordPress plugin before 3.1.4 does not perform authorization or ownership checks before returning support-ticket content in a nonce-gated search handler, allowing any authenticated user Subscriber and above to read the subject and full message body of every other user's support...
CVE-2026-15209: Authorization Bypass Through User-Controlled Key
The JS Help Desk WordPress plugin before 3.1.5 does not verify that the requesting user owns the ticket being loaded: a low-privileged authenticated user can supply another user's ticket ID and read that ticket's contents, including the reporter's PII and message body...
CVE-2026-14931: Exposure of Sensitive Information to an Unauthorized Actor
The JS Help Desk WordPress plugin before 3.1.4 grants a support-agent capability to the Contributor role on activation and does not perform a capability check on a user-listing handler, allowing Contributor-level users to enumerate the email addresses of all registered WordPress users...
CVE-2026-14930: Missing Authorization
The JS Help Desk WordPress plugin before 3.1.4 does not perform any authorization, nonce, or ownership check on a front-end request dispatcher, allowing unauthenticated users to upload files limited to the JS Help Desk WordPress plugin before 3.1.4's inert allowed extensions and attach them to...
CVE-2026-14929: Incorrect Authorization
The JS Help Desk WordPress plugin before 3.1.4 does not verify ownership of the targeted reply before updating it, allowing any authenticated user Subscriber and above to overwrite the content of any support-ticket reply on the site...
CVE-2026-14928: Exposure of Sensitive Information to an Unauthorized Actor
The JS Help Desk WordPress plugin before 3.1.4 does not perform authorization or ownership checks before returning support-ticket content in a nonce-gated search handler, allowing any authenticated user Subscriber and above to read the subject and full message body of every other user's support...
CVE-2026-57652 WordPress JS Help Desk plugin <= 3.1.0 - Insecure Direct Object References (IDOR) vulnerability
Unauthenticated Insecure Direct Object References IDOR in JS Help Desk = 3.1.0 versions...
WordPress JS Help Desk plugin <= 3.1.0 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by William Matos in WordPress Plugin JS Help Desk versions = 3.1.0...
CVE-2026-57652: Authorization Bypass Through User-Controlled Key
Unauthenticated Insecure Direct Object References IDOR in JS Help Desk = 3.1.0 versions...
CVE-2026-56054 WordPress JS Help Desk plugin <= 3.1.1 - Arbitrary File Deletion vulnerability
Subscriber Arbitrary File Deletion in JS Help Desk = 3.1.1 versions...
CVE-2026-56054 WordPress JS Help Desk plugin <= 3.1.1 - Arbitrary File Deletion vulnerability
Subscriber Arbitrary File Deletion in JS Help Desk = 3.1.1 versions...
CVE-2026-56054: Improper Limitation of a Pathname to a Restricted Directory
Subscriber Arbitrary File Deletion in JS Help Desk = 3.1.1 versions...
CVE-2026-48886
Unauthenticated SQL Injection in JS Help Desk = 3.0.9 versions...