Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

4 records

Vendor: vanquish Component: Woocommerce Support Ticket System Clear all filters
TI-2024-12803 CVE-2024-13775 · GHSA-vgxq-5hq8-w7m7

Missing authorization in vanquish WooCommerce Support Ticket System

Priority LOW 24

The WooCommerce Support Ticket System plugin for WordPress is vulnerable to unauthorized access and loss of data due to missing capability checks on the 'ajax_delete_message', 'ajax_get_customers_partial_list', and 'ajax…

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00242 Published 2025-02-01 No fix listed CWE-862
TI-2024-09848 CVE-2024-10627 · GHSA-qcjj-9353-w44w

WooCommerce Support Ticket System <= 17.7 - Unauthenticated Arbitrary File Upload

Priority MEDIUM 50

The WooCommerce Support Ticket System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajax_manage_file_chunk_upload() function in all versions up to, and including,…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00853 Published 2024-11-09 No fix listed CWE-434
TI-2024-09847 CVE-2024-10626 · GHSA-5377-vf52-34qw

WooCommerce Support Ticket System <= 17.7 - Authenticated (Subscriber+) Arbitrary File Deletion

Priority MEDIUM 42

The WooCommerce Support Ticket System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_uploaded_file() function in all versions up to, and including, 17…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00931 Published 2024-11-09 No fix listed CWE-22
TI-2024-09846 CVE-2024-10625 · GHSA-vfjx-j979-35fr

WooCommerce Support Ticket System <= 17.7 - Unauthenticated Arbitrary File Deletion

Priority MEDIUM 51

The WooCommerce Support Ticket System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_tmp_uploaded_file() function in all versions up to, and including…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01025 Published 2024-11-09 No fix listed CWE-22