---
id: "CVE-2026-118046"
page: "https://infrastack.ai/live/CVE-2026-118046"
kind: "vulnerability"
aliases: ["CVE-2026-118046"]
title: "JS Help Desk WordPress plugin: stored XSS via ticket message field"
severity: "medium"
cvss: 6.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["help-desk", "package", "self-hosted", "wordpress"]
not_affected_if: ["no-subscriber-accounts", "plugin-above-5.0.2", "plugin-not-installed"]
published_at: "2026-11-07T03:17:00+00:00"
first_seen_at: "2026-11-07T03:45:32+00:00"
updated_at: "2026-11-07T03:47:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118046", "first_seen_at": "2026-11-07T03:45:32+00:00"}]
exploit_sources: []
---

# JS Help Desk WordPress plugin: stored XSS via ticket message field

Link for people: https://infrastack.ai/live/CVE-2026-118046 (this .md is for agents)

The JS Help Desk WordPress plugin up to and including 5.0.2 fails to sanitize the jsticket_message parameter, so a logged-in subscriber can store script that runs when an administrator or support agent opens the ticket. The script runs in the staff member's browser, which can let an attacker act as that staff user on the site.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version in the WordPress admin plugin list or in the plugin's main file header, and see whether it is `5.0.2` or older.
- Look for the JS Help Desk plugin directory under `wp-content/plugins/`.

## Timeline

- 2026-11-07T03:45:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118046

## From the sources

The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'jsticket_message' parameter in all versions up to, and including, 5.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload fires specifically when an administrator or agent opens the affected ticket and the page initializes VenoBox, which reads the browser-decoded data-title attribute and passes it to jQuery .html(), making routine ticket review the trigger condition.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_