CVE-2026-118046 · Package
NO FIX YET
The JS Help Desk WordPress plugin up to and including 5.0.2 fails to sanitize the jsticket_message parameter, so a logged-in subscriber can store script that runs when an administrator or support agent opens the ticket. The script runs in the staff member's browser, which can let an attacker act as that staff user on the site.
first public Nov 7, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the JS Help Desk plugin at version 5.0.2 or older are exposed. The attacker needs a subscriber-level account on the site, and the script fires when staff open the injected ticket in the admin area. Sites without this plugin, or without open user registration, are much less exposed.
Not affected if no-subscriber-accounts, plugin-above-5.0.2, plugin-not-installed
Who cares help-desk, self-hosted, wordpress
5.0.2 or older.wp-content/plugins/.No fix yet, per the sources.
The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'jsticket_message' parameter in all versions up to, and including, 5.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload fires specifically when an administrator or agent opens the affected ticket and the page initializes VenoBox, which reads the browser-decoded data-title attribute and passes it to jQuery .html(), making routine ticket review the trigger condition.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.