{
 "id": "WPSEC-2026-2167",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2167/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2167/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2167/index.md",
 "title": "JS Help Desk – AI-Powered Support & Ticketing System <= 5.0.2 - Unauthenticated Stored Cross-Site Scripting via Ticket Message Image Viewer",
 "description": "The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ticket image viewer (VenoBox) in all versions up to, and including, 5.0.2. The viewer was started on every '.venobox' link on the admin and front-end ticket detail pages, including links inside ticket messages and replies written by customers. It then used those links' data-* attributes (such as data-href and data-vbtype) without escaping when it built the lightbox HTML. The ticket editor sanitiser keeps class and data-* attributes on links. This makes it possible for unauthenticated attackers, wherever guests can open tickets (the default), to inject arbitrary web scripts that run when an administrator or agent viewing the ticket clicks the injected link.",
 "plugin": {
  "slug": "js-support-ticket",
  "name": "JS Help Desk – AI-Powered Support & Ticketing System",
  "full_name": "JS Help Desk – AI-Powered Support & Ticketing System",
  "wordpress_org": "https://wordpress.org/plugins/js-support-ticket/",
  "advisories_url": "https://wpsec.com/vuln/plugin/js-support-ticket/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/js-support-ticket"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.1,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "5.0.3",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 5.0.3"
  ]
 },
 "introduced_in": null,
 "fixed_in": "5.0.3",
 "remediation": "Update to 5.0.3 or later.",
 "fix_released": "2026-10-30T04:56:18+00:00",
 "published": "2026-10-31T05:41:52+00:00",
 "updated": "2026-10-30T09:32:47.049017+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2167/",
  "https://plugins.svn.wordpress.org/js-support-ticket/tags/5.0.3/",
  "https://wordpress.org/plugins/js-support-ticket/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/js-support-ticket",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-31"
 }
}