Vulnerabilities

TI-2026-12575 CVE-2026-14931 · GHSA-4w98-gcq5-58rp

JS Help Desk < 3.1.4 - Contributor+ User Email Disclosure

MEDIUM 62

The JS Help Desk WordPress plugin before 3.1.4 grants a support-agent capability to the Contributor role on activation and does not perform a capability check on a user-listing handler, allowing Contributor-level users t…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00371 Published 2026-07-31 Fixed in 3.1.4 CWE-200

TI-2026-12574 CVE-2026-14930 · GHSA-pm33-j8g2-55v7

JS Help Desk < 3.1.4 - Unauthenticated Arbitrary Ticket File Attachment Upload

HIGH 72

The JS Help Desk WordPress plugin before 3.1.4 does not perform any authorization, nonce, or ownership check on a front-end request dispatcher, allowing unauthenticated users to upload files (limited to the JS Help Desk…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00406 Published 2026-07-31 Fixed in 3.1.4 CWE-862

TI-2026-12573 CVE-2026-14929 · GHSA-g256-5g3w-9rv9

JS Help Desk < 3.1.4 - Subscriber+ Ticket Reply Modification via IDOR

MEDIUM 53

The JS Help Desk WordPress plugin before 3.1.4 does not verify ownership of the targeted reply before updating it, allowing any authenticated user (Subscriber and above) to overwrite the content of any support-ticket rep…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00254 Published 2026-07-31 Fixed in 3.1.4 CWE-863

TI-2026-12572 CVE-2026-14928 · GHSA-ghj5-mpcj-95xg

JS Help Desk < 3.1.4 - Subscriber+ Sensitive Information Disclosure via checkAIReplyTicketsBySubject