EW
Product
ELEX WordPress HelpDesk & Customer Ticketing System
15
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 2High 5Medium 8Low 0
Watch
Add ELEX WordPress HelpDesk & Customer Ticketing System to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-103768 | 9.8 | Oct 16 | ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.7 - Unauthenticated Arbitrary File Upload via IMAP Email Attachment Affected: through 3.3.7 |
| CVE-2025-11456 | 9.8 | Nov 21 | ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Unauthenticated Arbitrary File Upload Affected: through 3.3.1 |
| CVE-2025-13534 | 8.8 | Dec 2 | ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.2 - Authenticated (Contributor+) Privilege Escalation via eh_crm_edit_agent AJAX Action Affected: through 3.3.2 |
| CVE-2025-47658 | 8.8 | May 23 | WordPress ELEX HelpDesk & Customer Ticketing System plugin <= 3.2.9 - Arbitrary File Upload vulnerability Affected: through 3.2.9 |
| CVE-2024-12171 | 8.8 | Feb 1 | ELEX WordPress HelpDesk & Customer Ticketing System <= 3.2.6 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation Affected: through 3.2.6 |
| CVE-2026-48964 | 8.5 | Jun 15 | WordPress ELEX WordPress HelpDesk & Customer Ticketing System plugin <= 3.3.6 - SQL Injection vulnerability Affected: through 3.3.6 |
| CVE-2025-9343 | 7.2 | Dec 21 | ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.4 - Unauthenticated Stored Cross-Site Scripting Affected: through 3.3.4 |
| CVE-2025-68837 | 6.5 | Feb 20 | WordPress ELEX WordPress HelpDesk & Customer Ticketing System plugin <= 3.3.5 - Broken Access Control vulnerability Affected: through 3.3.5 |
| CVE-2025-14079 | 5.3 | Feb 5 | ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.5 - Missing Authorization to Authenticated (Subscriber+) Settings Update Affected: through 3.3.5 |
| CVE-2025-10039 | 4.3 | Nov 21 | ELEX WordPress HelpDesk & Customer Ticketing System <= 3.2.9 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'eh_crm_ticket_single_view_client' Affected: through 3.2.9 |
| CVE-2025-10054 | 4.3 | Nov 21 | ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Role Removal Affected: through 3.3.1 |
| CVE-2025-12169 | 4.3 | Nov 21 | ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.0 - Missing Authorization to Authenitcated (Subscriber+) to Scheduled Trigger Deletion Affected: through 3.3.0 |
| CVE-2025-12022 | 4.3 | Nov 21 | ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Trash Restore Affected: through 3.3.1 |
| CVE-2025-12085 | 4.3 | Nov 21 | ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Trash Empty Affected: through 3.3.1 |
| CVE-2025-12023 | 4.3 | Nov 21 | ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Ticket Restore Affected: through 3.3.1 |
Showing 15