MediumVulnerability
CVE-2026-118046: JS Help Desk plugin stored DOM-based cross-site scripting via jsticket_message
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-118046
- Published
- Record updated
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
Summary
CVE-2026-118046 affects the JS Help Desk AI-Powered Support & Ticketing System plugin for WordPress in all versions up to and including 5.0.2. Insufficient input sanitization and output escaping of the 'jsticket_message' parameter allow stored DOM-based cross-site scripting, which an authenticated attacker with subscriber-level access or above can exploit. The payload runs when an administrator or agent opens the affected ticket, because VenoBox passes the browser-decoded data-title attribute to jQuery .html().
Mitigation
The source does not state a fix yet. Check the original advisory for updates.
Related items
- MediumClaude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHubSimilar attack · The Hacker News
- MediumARTEX abuse expands as cybercriminals target financial sectorSimilar attack · Microsoft Security Blog
- MediumCVE-2026-102610: fast-agent serve unauthenticated remote command execution via /mcp endpointSimilar attack · NVD/CVE Database
- CriticalCVE-2026-58490: Tracecat SAML authentication bypass through unsigned responses in Docker ComposeSimilar attack · NVD/CVE Database
- MediumCVE-2026-124028: mistral.rs delimiter injection allows attacker-chosen tool calls via quoted textSimilar attack · NVD/CVE Database