{
 "id": "WPSEC-2026-3021",
 "url": "https://wpsec.com/vuln/WPSEC-2026-3021/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-3021/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-3021/index.md",
 "title": "JS Help Desk – AI-Powered Support & Ticketing System <= 5.0.5 - Unauthenticated Stored Cross-Site Scripting via Ticket Message Image Viewer Links",
 "description": "The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via links in ticket messages, replies and notes in all versions up to, and including, 5.0.5, due to the bundled image viewer (venobox.js) building its content with content.html('<img src=\"'+dest+'\">') from a link's href or data-href, and insufficient removal of the viewer's data-vbtype/data-href markers and gallery items from user-written content (entity-encoded replies are decoded before output, and only double-quoted data-vbtype was stripped on save). This makes it possible for unauthenticated attackers who can submit tickets or replies to inject arbitrary web scripts that execute when an administrator, agent or customer opens the crafted link in the ticket's image viewer.",
 "plugin": {
  "slug": "js-support-ticket",
  "name": "JS Help Desk – AI-Powered Support & Ticketing System",
  "full_name": "JS Help Desk – AI-Powered Support & Ticketing System",
  "wordpress_org": "https://wordpress.org/plugins/js-support-ticket/",
  "advisories_url": "https://wpsec.com/vuln/plugin/js-support-ticket/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/js-support-ticket"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.1,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "5.0.6",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 5.0.6"
  ]
 },
 "introduced_in": null,
 "fixed_in": "5.0.6",
 "remediation": "Update to 5.0.6 or later.",
 "fix_released": "2026-11-12T06:24:32+00:00",
 "published": "2026-11-13T06:40:59+00:00",
 "updated": "2026-11-12T17:04:51.172641+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-3021/",
  "https://plugins.svn.wordpress.org/js-support-ticket/tags/5.0.6/",
  "https://wordpress.org/plugins/js-support-ticket/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/js-support-ticket",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-13"
 }
}