# JS Help Desk – AI-Powered Support & Ticketing System <= 5.0.2 - Unauthenticated Stored Cross-Site Scripting via Ticket Message Image Viewer

- **ID:** WPSEC-2026-2167
- **Plugin:** JS Help Desk – AI-Powered Support & Ticketing System (`js-support-ticket`), https://wordpress.org/plugins/js-support-ticket/
- **Affected versions:** all versions before 5.0.3
- **Fixed in:** 5.0.3 (Update to 5.0.3 or later.)
- **Severity:** Medium 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-31)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/js-support-ticket
- **Fix released:** 2026-10-30
- **Published:** 2026-10-31
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2167/

## Description

The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ticket image viewer (VenoBox) in all versions up to, and including, 5.0.2. The viewer was started on every '.venobox' link on the admin and front-end ticket detail pages, including links inside ticket messages and replies written by customers. It then used those links' data-* attributes (such as data-href and data-vbtype) without escaping when it built the lightbox HTML. The ticket editor sanitiser keeps class and data-* attributes on links. This makes it possible for unauthenticated attackers, wherever guests can open tickets (the default), to inject arbitrary web scripts that run when an administrator or agent viewing the ticket clicks the injected link.

## References

- https://wpsec.com/vuln/WPSEC-2026-2167/
- https://plugins.svn.wordpress.org/js-support-ticket/tags/5.0.3/
- https://wordpress.org/plugins/js-support-ticket/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2167/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.