Does JS Help Desk – AI-Powered Support & Ticketing System have any unpatched vulnerabilities?

No. All known vulnerabilities in JS Help Desk – AI-Powered Support & Ticketing System have been patched as of the latest data update. Always keep the plugin updated to the latest version.

Is JS Help Desk – AI-Powered Support & Ticketing System compatible with WordPress 6.9.4?

According to WordPress.org data, JS Help Desk – AI-Powered Support & Ticketing System 3.0.6 has been tested up to WordPress 6.9.4. Check the plugin's changelog for the latest compatibility information.

Is JS Help Desk – AI-Powered Support & Ticketing System compatible with PHP 7.4+?

JS Help Desk – AI-Powered Support & Ticketing System requires PHP 7.4 or higher. Most modern WordPress hosts run PHP 8.1 or 8.2. If you are on an older PHP version, consider upgrading before installing this plugin.

What is JS Help Desk – AI-Powered Support & Ticketing System's security score?

JS Help Desk – AI-Powered Support & Ticketing System has a WP-Safety security score of 76/100. This score is computed from CVE history, patch response time, developer trust signals, and plugin maintenance activity.

JS Help Desk – AI-Powered Support & Ticketing System Security & Risk Analysis

wordpress.org/plugins/js-support-ticket

Professional, beautiful, complete and powerful help desk & support system for WordPress.

6K active installs v3.0.6 PHP 7.4+ WP 5.5+ Updated Feb 24, 2026

ai-supporthelpdeskknowledgebasesupport-ticketticketing-system

B · Generally Safe

CVEs total21

Unpatched0

Last CVEMar 3, 2026

Plugin page Download

Safety Verdict

Is JS Help Desk – AI-Powered Support & Ticketing System Safe to Use in 2026?

Mostly Safe

Score 76/100

JS Help Desk – AI-Powered Support & Ticketing System is generally safe to use. 21 past CVEs were resolved. Keep it updated.

21 known CVEsLast CVE: Mar 3, 2026Updated 1mo ago

Risk Assessment

The "js-support-ticket" plugin v3.0.6 exhibits a concerning security posture, despite some positive aspects. While the plugin demonstrates a high degree of success in output escaping (97%) and utilizing prepared statements for SQL queries (91%), these strengths are overshadowed by critical weaknesses. The presence of a dangerous `unserialize` function is a significant red flag, as it can be exploited for remote code execution or deserialization vulnerabilities if not handled with extreme care. Furthermore, the taint analysis reveals a high number of flows with unsanitized paths, six of which are rated as high severity. This, coupled with unprotected AJAX handlers and a substantial history of 21 known CVEs across various severe vulnerability types, indicates a pattern of recurring security flaws. The plugin's past vulnerabilities include SQL Injection, Missing Authorization, Path Traversal, Code Injection, and Unrestricted File Uploads, suggesting a fundamental lack of robust security controls in its development lifecycle. The fact that the last vulnerability was dated in the future (2026) is also a temporal anomaly that needs to be addressed, but assuming it's an input error and considering the historical trend, the plugin has a history of being exploitable. The significant number of known vulnerabilities, combined with the identified code-level risks, presents a high risk to any WordPress site using this plugin.

Key Concerns

Dangerous function: unserialize detected
High severity taint flows with unsanitized paths
Unprotected AJAX handlers
Large number of known CVEs (21 total)
History of critical severity CVEs
History of high severity CVEs
History of medium severity CVEs
Common vulnerability types: SQLi, Missing Auth, RFI, Path Traversal, XSS, Code I

Vulnerabilities

JS Help Desk – AI-Powered Support & Ticketing System Security Vulnerabilities

CVEs by Year

1 CVE in 2018

2018

8 CVEs in 2023

2023

3 CVEs in 2024

2024

7 CVEs in 2025

2025

2 CVEs in 2026

2026

Patched Has unpatched

Severity Breakdown

Critical

High

Medium

21 total CVEs

CVE-2023-7337high · 7.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

JS Help Desk – AI-Powered Support & Ticketing System 2.8.2 - Unauthenticated SQL Injection via 'js-support-ticket-token-tkstatus' Cookie

Mar 3, 2026 Patched in 2.8.3 (1d)

CVE-2026-24959medium · 6.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

JS Help Desk <= 3.0.1 - Authenticated (Subscriber+) SQL Injection

Feb 11, 2026 Patched in 3.0.2 (6d)

CVE-2025-30886high · 7.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

JS Help Desk <= 2.9.2 - Unauthenticated SQL Injection

Mar 27, 2025 Patched in 2.9.3 (7d)

CVE-2025-30880medium · 5.3Missing Authorization

JS Help Desk <= 2.9.2 - Missing Authorization

Mar 27, 2025 Patched in 2.9.3 (7d)

CVE-2025-30901critical · 9.8Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

JS Help Desk <= 2.9.2 - Unauthenticated Local File Inclusion

Mar 27, 2025 Patched in 2.9.3 (7d)

CVE-2025-30882high · 7.5Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

JS Help Desk <= 2.9.1 - Unauthenticated Arbitrary File Download

Mar 27, 2025 Patched in 2.9.2 (7d)

CVE-2025-30878critical · 9.1Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

JS Help Desk <= 2.9.2 - Unauthenticated Arbitrary File Deletion

Mar 27, 2025 Patched in 2.9.3 (7d)

CVE-2024-13606high · 7.5Exposure of Sensitive Information to an Unauthorized Actor

JS Help Desk – The Ultimate Help Desk & Support Plugin <= 2.8.8 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory

Feb 12, 2025 Patched in 2.8.9 (23d)

CVE-2024-13607medium · 4.3Authorization Bypass Through User-Controlled Key

JS Help Desk – The Ultimate Help Desk & Support Plugin <= 2.8.8 - Authenticated (Subscriber+) Insecure Direct Object Reference

Feb 3, 2025 Patched in 2.8.9 (1d)

CVE-2024-51670medium · 4.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

JS Help Desk – Best Help Desk & Support Plugin <= 2.8.7 - Authenticated (Administrator+) Stored Cross-Site Scripting

Nov 1, 2024 Patched in 2.8.8 (6d)

CVE-2024-7094critical · 9.8Improper Control of Generation of Code ('Code Injection')

JS Help Desk – The Ultimate Help Desk & Support Plugin <= 2.8.6 - Unauthenticated PHP Code Injection to Remote Code Execution

Aug 12, 2024 Patched in 2.8.7 (7d)

CVE-2024-31273medium · 5.3Missing Authorization

JS Help Desk – Best Help Desk & Support Plugin <= 2.8.3 - Missing Authorization

Apr 5, 2024 Patched in 2.8.4 (7d)

CVE-2023-50839critical · 9.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

JS Help Desk <= 2.8.1 - Unauthenticated SQL Injection via email and trackingid

Dec 21, 2023 Patched in 2.8.2 (33d)

CVE-2023-25444high · 7.2Unrestricted Upload of File with Dangerous Type

JS Help Desk – Best Help Desk & Support Plugin <= 2.7.7 - Authenticated (Administrator+) Arbitrary File Upload

Aug 17, 2023 Patched in 2.7.8 (159d)

CVE-2023-23679medium · 6.3Authorization Bypass Through User-Controlled Key

JS Help Desk – Best Help Desk & Support Plugin <= 2.7.7 - Authenticated (Subscriber+) Insecure Direct Object Reference

Jun 20, 2023 Patched in 2.7.8 (217d)

CVE-2022-46839critical · 9.8Unrestricted Upload of File with Dangerous Type

JS Help Desk <= 2.7.1 - Unauthenticated Arbitrary File Upload