ELEX WordPress HelpDesk & Customer Ticketing System vulnerabilities
9 known vulnerabilities in ELEX WordPress HelpDesk & Customer Ticketing System from Elextensions. 9 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.8 Critical severity
ELEX WordPress HelpDesk & Customer Ticketing…: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in Elextensions ELEX WordPress HelpDesk & Customer Ticketing System elex-helpdesk-customer-support-ticket-system allows Object Injection.This issue affects ELEX WordPress HelpDesk & Customer Ticketing System: fro
- 9.8 Critical severity
ELEX WordPress HelpDesk & Customer Ticketing…: Deserialization of Untrusted Data
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.3.9 via the 'form (specifically the attacker-controlled ticket_label field inside the url-encoded form st
- 9.1 Critical severity
ELEX WordPress HelpDesk & Customer Ticketing…: Improper Limitation of a Pathname to a Restricted Directory
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the factory_reset function in all versions up to, and including, 3.3.8 This makes it possible for
- 9.8 Critical severity
ELEX WordPress HelpDesk & Customer Ticketing…: Unrestricted Upload of File with Dangerous Type
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.3.7 via the initMailPart function. This is due to insufficient file type validation when saving IMAP ema
- 7.2 High severity
ELEX WordPress HelpDesk & Customer Ticketing…: Improper Neutralization of Input During Web Page Generation
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via ticket subjects in all versions up to, and including, 3.3.4 due to insufficient input sanitization and output escaping. This makes it
- 8.8 High severity
ELEX WordPress HelpDesk & Customer Ticketing…: Improper Privilege Management
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.3.2. This is due to missing authorization checks on the eh_crm_edit_agent AJAX action. This makes it poss
- 9.8 Critical severity
ELEX WordPress HelpDesk & Customer Ticketing…: Unrestricted Upload of File with Dangerous Type
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the eh_crm_new_ticket_post() function in all versions up to, and including, 3.3.1. This makes it possibl
- 8.8 High severity
ELEX WordPress HelpDesk & Customer Ticketing…: Unrestricted Upload of File with Dangerous Type
Unrestricted Upload of File with Dangerous Type vulnerability in ELEXtensions ELEX WordPress HelpDesk & Customer Ticketing System elex-helpdesk-customer-support-ticket-system allows Upload a Web Shell to a Web Server.This issue affects ELEX WordPress HelpDesk
- 8.8 High severity
ELEX WordPress HelpDesk & Customer Ticketing…: Missing Authorization
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the 'eh_crm_agent_add_user' AJAX action in all versions up to, and including, 3.2.6. This makes it possible