Plugin security history

JS Help Desk – AI-Powered Support & Ticketing System Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 28 vulnerability records associated with JS Help Desk – AI-Powered Support & Ticketing System, published between 2018 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

28Total records

6Critical

10High

12Medium

0Low

0Informational

28Patched records

0Currently marked unpatched

2018-06-25First disclosure

2026-06-26Latest disclosure

28 of 28CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2018	1	1 records
2023	8	8 records
2024	3	3 records
2025	7	7 records
2026	9	9 records

Severity Breakdown

Severity	Records	Share
Critical	6	21.4%
High	10	35.7%
Medium	12	42.9%

Vulnerability-Type Breakdown

Missing Authorization

9 records32.1%

First: 2023. Latest: 2026.

SQL Injection

8 records28.6%

First: 2023. Latest: 2026.

Path Traversal

3 records10.7%

First: 2025. Latest: 2026.

CSRF

2 records7.1%

First: 2018. Latest: 2023.

Arbitrary File Upload

2 records7.1%

First: 2023. Latest: 2023.

Other

2 records7.1%

First: 2024. Latest: 2025.

Cross-Site Scripting

1 record3.6%

First: 2024. Latest: 2024.

Information Disclosure

1 record3.6%

First: 2025. Latest: 2025.

Patch Status

Patched: 28
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

3.1.1
3.1.2
3.1.0
3.0.5
3.0.4
2.8.3
3.0.2
2.9.2
2.9.3
2.8.9
2.8.8
2.8.7
2.8.4
2.8.2
2.7.8
2.7.2
2.0.6

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-3.1.0`	JS Help Desk – AI-Powered Support & Ticketing System <= 3.1.0 - Unauthenticated Insecure Direct Object Reference	June 26, 2026	3.1.1	Medium
`*-3.1.1`	JS Help Desk – AI-Powered Support & Ticketing System <= 3.1.1 - Authenticated (Subscriber+) Arbitrary File Deletion	June 25, 2026	3.1.2	High
`*-3.0.9`	JS Help Desk – AI-Powered Support & Ticketing System <= 3.0.9 - Unauthenticated SQL Injection	June 2, 2026	3.1.0	High
`*-3.0.9`	JS Help Desk – AI-Powered Support & Ticketing System <= 3.0.9 - Missing Authorization	June 2, 2026	3.1.0	Medium
`*-3.0.4`	JS Help Desk – AI-Powered Support & Ticketing System <= 3.0.4 - Unauthenticated SQL Injection via 'multiformid' Parameter	March 25, 2026	3.0.5	High
`*-3.0.3`	JS Help Desk – AI-Powered Support & Ticketing System <= 3.0.3 - Authenticated (Subscriber+) Insecure Direct Object Reference	March 23, 2026	3.0.4	Medium
`*-3.0.3`	JS Help Desk – AI-Powered Support & Ticketing System <= 3.0.3 - Authenticated (Subscriber+) SQL Injection	March 20, 2026	3.0.4	Medium
`*-2.8.2`	JS Help Desk – AI-Powered Support & Ticketing System 2.8.2 - Unauthenticated SQL Injection via 'js-support-ticket-token-tkstatus' Cookie	March 3, 2026	2.8.3	High
`*-3.0.1`	JS Help Desk <= 3.0.1 - Authenticated (Subscriber+) SQL Injection	February 11, 2026	3.0.2	Medium
`*-2.9.2`	JS Help Desk <= 2.9.2 - Unauthenticated Arbitrary File Deletion	March 27, 2025	2.9.3	Critical
`*-2.9.1`	JS Help Desk <= 2.9.1 - Unauthenticated Arbitrary File Download	March 27, 2025	2.9.2	High
`*-2.9.2`	JS Help Desk <= 2.9.2 - Unauthenticated Local File Inclusion	March 27, 2025	2.9.3	Critical
`*-2.9.2`	JS Help Desk <= 2.9.2 - Missing Authorization	March 27, 2025	2.9.3	Medium
`*-2.9.2`	JS Help Desk <= 2.9.2 - Unauthenticated SQL Injection	March 27, 2025	2.9.3	High
`*-2.8.8`	JS Help Desk – The Ultimate Help Desk & Support Plugin <= 2.8.8 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory	February 12, 2025	2.8.9	High
`*-2.8.8`	JS Help Desk – The Ultimate Help Desk & Support Plugin <= 2.8.8 - Authenticated (Subscriber+) Insecure Direct Object Reference	February 3, 2025	2.8.9	Medium
`*-2.8.7`	JS Help Desk – Best Help Desk & Support Plugin <= 2.8.7 - Authenticated (Administrator+) Stored Cross-Site Scripting	November 1, 2024	2.8.8	Medium
`*-2.8.6`	JS Help Desk – The Ultimate Help Desk & Support Plugin <= 2.8.6 - Unauthenticated PHP Code Injection to Remote Code Execution	August 12, 2024	2.8.7	Critical
`*-2.8.3`	JS Help Desk – Best Help Desk & Support Plugin <= 2.8.3 - Missing Authorization	April 5, 2024	2.8.4	Medium
`[*, 2.8.2)`	JS Help Desk <= 2.8.1 - Unauthenticated SQL Injection via email and trackingid	December 21, 2023	2.8.2	Critical
`*-2.7.7`	JS Help Desk – Best Help Desk & Support Plugin <= 2.7.7 - Authenticated (Administrator+) Arbitrary File Upload	August 17, 2023	2.7.8	High
`*-2.7.7`	JS Help Desk – Best Help Desk & Support Plugin <= 2.7.7 - Authenticated (Subscriber+) Insecure Direct Object Reference	June 20, 2023	2.7.8	Medium
`*-2.7.1`	JS Help Desk <= 2.7.1 - Cross-Site Request Forgery	January 27, 2023	2.7.2	Medium
`*-2.7.1`	JS Help Desk <= 2.7.1 - Unauthenticated SQL Injection	January 27, 2023	2.7.2	High
`2.7.1`	JS Help Desk <= 2.7.1 - Missing Authorization to Plugin Settings Update	January 27, 2023	2.7.2	Critical

Selected source records

Latest Records

MediumCVE-2026-57652

JS Help Desk – AI-Powered Support & Ticketing System <= 3.1.0 - Unauthenticated Insecure Direct Object Reference

Published: June 26, 2026

Affected versions: *-3.1.0
Patched versions: 3.1.1

Original Wordfence record

HighCVE-2026-56054

JS Help Desk – AI-Powered Support & Ticketing System <= 3.1.1 - Authenticated (Subscriber+) Arbitrary File Deletion

Published: June 25, 2026

Affected versions: *-3.1.1
Patched versions: 3.1.2

Original Wordfence record

MediumCVE-2026-48887

JS Help Desk – AI-Powered Support & Ticketing System <= 3.0.9 - Missing Authorization

Published: June 2, 2026

Affected versions: *-3.0.9
Patched versions: 3.1.0

Original Wordfence record

HighCVE-2026-48886

JS Help Desk – AI-Powered Support & Ticketing System <= 3.0.9 - Unauthenticated SQL Injection

Published: June 2, 2026

Affected versions: *-3.0.9
Patched versions: 3.1.0

Original Wordfence record

HighCVE-2026-2511

JS Help Desk – AI-Powered Support & Ticketing System <= 3.0.4 - Unauthenticated SQL Injection via 'multiformid' Parameter

Published: March 25, 2026

Affected versions: *-3.0.4
Patched versions: 3.0.5

Original Wordfence record

MediumCVE-2026-32535

JS Help Desk – AI-Powered Support & Ticketing System <= 3.0.3 - Authenticated (Subscriber+) Insecure Direct Object Reference

Published: March 23, 2026

Affected versions: *-3.0.3
Patched versions: 3.0.4

Original Wordfence record

MediumCVE-2026-32534

JS Help Desk – AI-Powered Support & Ticketing System <= 3.0.3 - Authenticated (Subscriber+) SQL Injection

Published: March 20, 2026

Affected versions: *-3.0.3
Patched versions: 3.0.4

Original Wordfence record

HighCVE-2023-7337

JS Help Desk – AI-Powered Support & Ticketing System 2.8.2 - Unauthenticated SQL Injection via 'js-support-ticket-token-tkstatus' Cookie

Published: March 3, 2026

Affected versions: *-2.8.2
Patched versions: 2.8.3

Original Wordfence record

Highest-Severity Records

CriticalCVE-2024-7094

JS Help Desk – The Ultimate Help Desk & Support Plugin <= 2.8.6 - Unauthenticated PHP Code Injection to Remote Code Execution

Published: August 12, 2024

Affected versions: *-2.8.6
Patched versions: 2.8.7

Original Wordfence record

CriticalCVE-2022-46839

JS Help Desk <= 2.7.1 - Unauthenticated Arbitrary File Upload

Published: January 27, 2023

Affected versions: *-2.7.1
Patched versions: 2.7.2

Original Wordfence record

CriticalCVE-2025-30901

JS Help Desk <= 2.9.2 - Unauthenticated Local File Inclusion

Published: March 27, 2025

Affected versions: *-2.9.2
Patched versions: 2.9.3

Original Wordfence record

CriticalCVE-2023-50839

JS Help Desk <= 2.8.1 - Unauthenticated SQL Injection via email and trackingid

Published: December 21, 2023

Affected versions: [*, 2.8.2)
Patched versions: 2.8.2

Original Wordfence record

CriticalCVE-2022-46838

JS Help Desk <= 2.7.1 - Missing Authorization to Plugin Settings Update

Published: January 27, 2023

Affected versions: 2.7.1
Patched versions: 2.7.2

Original Wordfence record

CriticalCVE-2025-30878

JS Help Desk <= 2.9.2 - Unauthenticated Arbitrary File Deletion

Published: March 27, 2025

Affected versions: *-2.9.2
Patched versions: 2.9.3

Original Wordfence record

HighCVE-2026-56054

JS Help Desk – AI-Powered Support & Ticketing System <= 3.1.1 - Authenticated (Subscriber+) Arbitrary File Deletion

Published: June 25, 2026

Affected versions: *-3.1.1
Patched versions: 3.1.2

Original Wordfence record

HighCVE-2018-21002

JS Help Desk – Best Help Desk & Support Plugin <= 2.0.5 - Cross-Site Request Forgery

Published: June 25, 2018

Affected versions: *-2.0.5
Patched versions: 2.0.6

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory