JS Help Desk – AI-Powered Support & Ticketing System <= 5.0.2 - Unauthenticated Stored Cross-Site Scripting via Ticket Message Image Viewer
- ID
- WPSEC-2026-2167
- Plugin
- JS Help Desk – AI-Powered Support & Ticketing System (js-support-ticket)
- Affected
- all versions before 5.0.3
- Remediation
- Update to 5.0.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-31
- Attack surface
- JS Help Desk – AI-Powered Support & Ticketing System on WPSec AttackSurface
- Fix released
- Published
Description
The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ticket image viewer (VenoBox) in all versions up to, and including, 5.0.2. The viewer was started on every '.venobox' link on the admin and front-end ticket detail pages, including links inside ticket messages and replies written by customers. It then used those links' data-* attributes (such as data-href and data-vbtype) without escaping when it built the lightbox HTML. The ticket editor sanitiser keeps class and data-* attributes on links. This makes it possible for unauthenticated attackers, wherever guests can open tickets (the default), to inject arbitrary web scripts that run when an administrator or agent viewing the ticket clicks the injected link.
References
- https://wpsec.com/vuln/WPSEC-2026-2167/
- https://plugins.svn.wordpress.org/js-support-ticket/tags/5.0.3/
- https://wordpress.org/plugins/js-support-ticket/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS