Unknown Js Help Desk vulnerabilities

5 CVEs affecting Unknown Js Help Desk, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-15209, published 2026-07-31.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-14930, published 2026-07-31. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. The JS Help Desk WordPress plugin before 3.1.4 does not perform any authorization, nonce, or ownership check on a front-end request dispatcher, allowing unauthenticated users to upload files…
CVE-2026-14931, published 2026-07-31. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. The JS Help Desk WordPress plugin before 3.1.4 grants a support-agent capability to the Contributor role on activation and does not perform a capability check on a user-listing handler, allowing…
CVE-2026-14928, published 2026-07-31. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. The JS Help Desk WordPress plugin before 3.1.4 does not perform authorization or ownership checks before returning support-ticket content in a nonce-gated search handler, allowing any authenticated…
CVE-2026-15209, published 2026-07-31. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. The JS Help Desk WordPress plugin before 3.1.5 does not verify that the requesting user owns the ticket being loaded: a low-privileged authenticated user can supply another user's ticket ID and read…
CVE-2026-14929, published 2026-07-31. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. The JS Help Desk WordPress plugin before 3.1.4 does not verify ownership of the targeted reply before updating it, allowing any authenticated user (Subscriber and above) to overwrite the content of…