{
 "id": "WPSEC-2026-3022",
 "url": "https://wpsec.com/vuln/WPSEC-2026-3022/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-3022/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-3022/index.md",
 "title": "JS Help Desk – AI-Powered Support & Ticketing System <= 5.0.5 - Unauthenticated Stored Cross-Site Scripting via 'smooth-scroll' Links in Ticket Content",
 "description": "The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via links with the 'smooth-scroll' class in ticket messages, replies and notes in all versions up to, and including, 5.0.5, due to the admin ticket detail page passing the href of any a.smooth-scroll link to jQuery(), which parses a value beginning with '<' as HTML. This makes it possible for unauthenticated attackers who can submit tickets or replies to inject arbitrary web scripts that execute when an administrator views the ticket and clicks the crafted link.",
 "plugin": {
  "slug": "js-support-ticket",
  "name": "JS Help Desk – AI-Powered Support & Ticketing System",
  "full_name": "JS Help Desk – AI-Powered Support & Ticketing System",
  "wordpress_org": "https://wordpress.org/plugins/js-support-ticket/",
  "advisories_url": "https://wpsec.com/vuln/plugin/js-support-ticket/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/js-support-ticket"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.1,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "5.0.6",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 5.0.6"
  ]
 },
 "introduced_in": null,
 "fixed_in": "5.0.6",
 "remediation": "Update to 5.0.6 or later.",
 "fix_released": "2026-11-12T06:24:32+00:00",
 "published": "2026-11-13T06:40:59+00:00",
 "updated": "2026-11-12T17:04:51.172641+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-3022/",
  "https://plugins.svn.wordpress.org/js-support-ticket/tags/5.0.6/",
  "https://wordpress.org/plugins/js-support-ticket/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/js-support-ticket",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-13"
 }
}