Vulnerabilities

TI-2026-01507 CVE-2026-1832 · GHSA-m58j-w5gx-pqhj

ThriveDesk <= 2.1.7 - Missing Authorization to Authenticated (Subscriber+) Cache Deletion

LOW 20

The ThriveDesk – Live Chat, AI Chatbot, Helpdesk & Knowledge Base plugin for WordPress is vulnerable to unauthorized cache deletion due to a missing capability check on the 'thrivedesk_clear_cache' AJAX action in all ver…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00354 Published 2026-07-11 No fix listed CWE-862

TI-2025-18253 CVE-2025-24536 · GHSA-fjcm-jgq9-qwjc

WordPress ThriveDesk plugin <= 2.0.6 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThriveDesk ThriveDesk thrivedesk allows Reflected XSS.This issue affects ThriveDesk: from n/a through <= 2.0.6.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00327 Published 2025-02-03 No fix listed CWE-79

Vulnerabilities

Filters

ThriveDesk <= 2.1.7 - Missing Authorization to Authenticated (Subscriber+) Cache Deletion

WordPress ThriveDesk plugin <= 2.0.6 - Reflected Cross Site Scripting (XSS) vulnerability