{"id":"CVE-2026-118046","kind":"vulnerability","aliases":["CVE-2026-118046"],"related":[],"title":"JS Help Desk WordPress plugin: stored XSS via ticket message field","description":"The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'jsticket_message' parameter in all versions up to, and including, 5.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload fires specifically when an administrator or agent opens the affected ticket and the page initializes VenoBox, which reads the browser-decoded data-title attribute and passes it to jQuery .html(), making routine ticket review the trigger condition.","summary":"The JS Help Desk WordPress plugin up to and including 5.0.2 fails to sanitize the jsticket_message parameter, so a logged-in subscriber can store script that runs when an administrator or support agent opens the ticket. The script runs in the staff member's browser, which can let an attacker act as that staff user on the site.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["help-desk","package","self-hosted","wordpress"],"not_affected_if":["no-subscriber-accounts","plugin-above-5.0.2","plugin-not-installed"],"how_to_check":"- Check the installed plugin version in the WordPress admin plugin list or in the plugin's main file header, and see whether it is `5.0.2` or older.\n- Look for the JS Help Desk plugin directory under `wp-content/plugins/`.","fix":null,"status":"open","published_at":"2026-11-07T03:17:00+00:00","first_seen_at":"2026-11-07T03:45:32+00:00","triaged_at":"2026-11-07T03:47:54+00:00","updated_at":"2026-11-07T03:47:54+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-07T03:47:54Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"JS Help Desk WordPress plugin: stored XSS via ticket message field","impact":"medium","summary":"The JS Help Desk WordPress plugin up to and including 5.0.2 fails to sanitize the jsticket_message parameter, so a logged-in subscriber can store script that runs when an administrator or support agent opens the ticket. The script runs in the staff member's browser, which can let an attacker act as that staff user on the site.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","self-hosted","help-desk"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Script runs in staff browser, enabling admin session actions","analyst_note":"Confirm the patched version of the JS Help Desk plugin on the NVD entry or the plugin vendor's changelog; sources give only the 5.0.2 upper bound.","how_to_check":"- Check the installed plugin version in the WordPress admin plugin list or in the plugin's main file header, and see whether it is `5.0.2` or older.\n- Look for the JS Help Desk plugin directory under `wp-content/plugins/`.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-above-5.0.2","no-subscriber-accounts"],"who_is_affected":"Sites running the JS Help Desk plugin at version 5.0.2 or older are exposed. The attacker needs a subscriber-level account on the site, and the script fires when staff open the injected ticket in the admin area. Sites without this plugin, or without open user registration, are much less exposed.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000746,"input_tokens":4380,"output_tokens":615,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-118046':14A,17A '-2026':13A,16A '5.0.2':36B,122C 'access':142C,158C 'act':78B 'administr':57B,168C 'affect':173C 'agent':60B,170C 'ai':91C 'ai-pow':90C 'arbitrari':147C 'attack':77B,137C 'attribut':189C 'authent':136C 'base':105C 'browser':72B,184C 'browser-decod':183C 'condit':202C 'cross':107C 'cross-sit':106C 'cve':12A,15A 'data':187C 'data-titl':186C 'decod':185C 'desk':3A,20B,29B,89C 'dom':104C 'dom-bas':103C 'due':123C 'escap':130C 'execut':154C 'fail':37B 'field':11A 'fire':164C 'help':2A,19B,28B,88C 'help-desk':18B 'host':24B 'html':195C 'includ':35B,121C 'initi':178C 'inject':146C,160C 'input':126C 'insuffici':125C 'jqueri':194C 'js':1A,27B,87C 'jsticket':41B,112C 'let':75B 'level':141C 'log':47B 'logged-in':46B 'make':132C,196C 'member':70B 'messag':10A,42B,113C 'open':61B,171C 'output':129C 'packag':21B 'page':151C,161C,177C 'paramet':43B,114C 'pass':191C 'payload':163C 'plugin':5A,31B,96C 'possibl':134C 'power':92C 'read':181C 'review':199C 'routin':197C 'run':54B,66B 'sanit':39B,127C 'script':52B,65B,109C,149C 'self':23B 'self-host':22B 'site':85B,108C 'specif':165C 'staff':69B,81B 'store':6A,51B,102C 'subscrib':49B,140C 'subscriber-level':139C 'support':59B,93C 'system':95C 'ticket':9A,63B,94C,174C,198C 'titl':188C 'trigger':201C 'user':82B,157C 'venobox':179C 'version':117C 'via':8A,110C 'vulner':100C 'web':148C 'whenev':155C 'wordpress':4A,25B,30B,98C 'xss':7A","nicknames":[],"mitigations":[],"who_affected":"Sites running the JS Help Desk plugin at version 5.0.2 or older are exposed. The attacker needs a subscriber-level account on the site, and the script fires when staff open the injected ticket in the admin area. Sites without this plugin, or without open user registration, are much less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["helpdesk","medium","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-118046':14A,17A '-2026':13A,16A 'cve':12A,15A 'desk':3A 'field':11A 'help':2A 'js':1A 'messag':10A 'plugin':5A 'store':6A 'ticket':9A 'via':8A 'wordpress':4A 'xss':7A","search_b":"'5.0.2':36B 'act':78B 'administr':57B 'agent':60B 'attack':77B 'browser':72B 'desk':20B,29B 'fail':37B 'help':19B,28B 'help-desk':18B 'host':24B 'includ':35B 'js':27B 'jsticket':41B 'let':75B 'log':47B 'logged-in':46B 'member':70B 'messag':42B 'open':61B 'packag':21B 'paramet':43B 'plugin':31B 'run':54B,66B 'sanit':39B 'script':52B,65B 'self':23B 'self-host':22B 'site':85B 'staff':69B,81B 'store':51B 'subscrib':49B 'support':59B 'ticket':63B 'user':82B 'wordpress':25B,30B","search_c":"'5.0.2':122C 'access':142C,158C 'administr':168C 'affect':173C 'agent':170C 'ai':91C 'ai-pow':90C 'arbitrari':147C 'attack':137C 'attribut':189C 'authent':136C 'base':105C 'browser':184C 'browser-decod':183C 'condit':202C 'cross':107C 'cross-sit':106C 'data':187C 'data-titl':186C 'decod':185C 'desk':89C 'dom':104C 'dom-bas':103C 'due':123C 'escap':130C 'execut':154C 'fire':164C 'help':88C 'html':195C 'includ':121C 'initi':178C 'inject':146C,160C 'input':126C 'insuffici':125C 'jqueri':194C 'js':87C 'jsticket':112C 'level':141C 'make':132C,196C 'messag':113C 'open':171C 'output':129C 'page':151C,161C,177C 'paramet':114C 'pass':191C 'payload':163C 'plugin':96C 'possibl':134C 'power':92C 'read':181C 'review':199C 'routin':197C 'sanit':127C 'script':109C,149C 'site':108C 'specif':165C 'store':102C 'subscrib':140C 'subscriber-level':139C 'support':93C 'system':95C 'ticket':94C,174C,198C 'titl':188C 'trigger':201C 'user':157C 'venobox':179C 'version':117C 'via':110C 'vulner':100C 'web':148C 'whenev':155C 'wordpress':98C","first_public_at":"2026-11-07T03:17:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118046","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118046","severity":null,"published_at":"2026-11-07T03:17:00+00:00","modified_at":"2026-11-07T03:17:00+00:00","first_seen_at":"2026-11-07T03:45:32+00:00","fetched_at":"2026-11-07T03:45:32+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}