Elextensions vulnerabilities
We track 14 vulnerabilities in Elextensions products across 5 products. 14 are rated high or critical, and none are known to be exploited. The most recent was published on November 13, 2026.
Latest Elextensions vulnerabilities
- 9.8 Critical severity
ELEX WordPress HelpDesk & Customer Ticketing…: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in Elextensions ELEX WordPress HelpDesk & Customer Ticketing System elex-helpdesk-customer-support-ticket-system allows Object Injection.This issue affects ELEX WordPress HelpDesk & Customer Ticketing System: fro
- 9.8 Critical severity
ELEX WordPress HelpDesk & Customer Ticketing…: Deserialization of Untrusted Data
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.3.9 via the 'form (specifically the attacker-controlled ticket_label field inside the url-encoded form st
- 9.1 Critical severity
ELEX WordPress HelpDesk & Customer Ticketing…: Improper Limitation of a Pathname to a Restricted Directory
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the factory_reset function in all versions up to, and including, 3.3.8 This makes it possible for
- 9.8 Critical severity
ELEX WordPress HelpDesk & Customer Ticketing…: Unrestricted Upload of File with Dangerous Type
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.3.7 via the initMailPart function. This is due to insufficient file type validation when saving IMAP ema
- 7.2 High severity
ELEX WordPress HelpDesk & Customer Ticketing…: Improper Neutralization of Input During Web Page Generation
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via ticket subjects in all versions up to, and including, 3.3.4 due to insufficient input sanitization and output escaping. This makes it
- 8.8 High severity
ELEX WordPress HelpDesk & Customer Ticketing…: Improper Privilege Management
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.3.2. This is due to missing authorization checks on the eh_crm_edit_agent AJAX action. This makes it poss
- 9.8 Critical severity
ELEX WordPress HelpDesk & Customer Ticketing…: Unrestricted Upload of File with Dangerous Type
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the eh_crm_new_ticket_post() function in all versions up to, and including, 3.3.1. This makes it possibl
- 9.9 Critical severity
ReachShip WooCommerce Multi-Carrier &…: Unrestricted Upload of File with Dangerous Type
Unrestricted Upload of File with Dangerous Type vulnerability in ELEXtensions ReachShip WooCommerce Multi-Carrier & Conditional Shipping elex-reachship-multi-carrier-conditional-shipping allows Using Malicious Files.This issue affects ReachShip WooCommerce Mul
- 8.5 High severity
ELEX WooCommerce Advanced Bulk Edit Products…: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes elex-bulk-edit-products-prices-attributes-for-woocommerce-basic allows SQL Inje
- 8.8 High severity
ELEX WordPress HelpDesk & Customer Ticketing…: Unrestricted Upload of File with Dangerous Type
Unrestricted Upload of File with Dangerous Type vulnerability in ELEXtensions ELEX WordPress HelpDesk & Customer Ticketing System elex-helpdesk-customer-support-ticket-system allows Upload a Web Shell to a Web Server.This issue affects ELEX WordPress HelpDesk
- 7.6 High severity
ELEX Product Feed for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ELEXtensions ELEX Product Feed for WooCommerce allows SQL Injection. This issue affects ELEX Product Feed for WooCommerce: from n/a through 3.1.2.
- 8.8 High severity
ELEX WordPress HelpDesk & Customer Ticketing…: Missing Authorization
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the 'eh_crm_agent_add_user' AJAX action in all versions up to, and including, 3.2.6. This makes it possible
- 7.6 High severity
ELEX WooCommerce Advanced Bulk Edit Products…: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes elex-bulk-edit-products-prices-attributes-for-woocommerce-basic allows Blind SQ
- 7.1 High severity
ELEX WooCommerce Dynamic Pricing and Discounts: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ELEXtensions ELEX WooCommerce Dynamic Pricing and Discounts allows Reflected XSS.This issue affects ELEX WooCommerce Dynamic Pricing and Discounts: from n/a t