What is the CVSS score of CVE-2026-32534?

CVE-2026-32534 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of Js Help Desk are affected by CVE-2026-32534?

CVE-2026-32534 presents significant security risk, a SQL injection vulnerability rated CVSS 8.5.

How to fix or mitigate CVE-2026-32534?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Validate that input sanitization is in place for all user-controlled parameters.

Js Help Desk CVE-2026-32534

EUVD-2026-15907 HIGH

SQL Injection (CWE-89)

2026-03-25 Patchstack

GHSA-gm23-98vv-4987

SQLi Js Help Desk

8.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15907

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:15 nvd

HIGH 8.5

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JoomSky JS Help Desk js-support-ticket allows Blind SQL Injection.This issue affects JS Help Desk: from n/a through <= 3.0.3.

AnalysisAI

JoomSky JS Help Desk contains a blind SQL injection vulnerability in versions through 3.0.3 that allows attackers to execute arbitrary SQL commands against the underlying database. The vulnerability affects the JS Help Desk plugin (identified via CPE cpe:2.3:a:joomsky:js_help_desk) and was reported by Patchstack. While no CVSS score or EPSS data is currently available, the blind SQL injection classification (CWE-89) indicates a serious data exfiltration and potential privilege escalation risk; however, the lack of CVE metadata and KEV designation suggests this may be a newer or less widely exploited vulnerability pending full disclosure and vendor patch release.

Technical ContextAI

The vulnerability stems from improper neutralization of special SQL metacharacters in user-supplied input, classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). JoomSky JS Help Desk, identified via CPE cpe:2.3:a:joomsky:js_help_desk:*:*:*:*:*:*:*:*, is a support ticket management plugin that processes user input without adequate parameterized query enforcement or input validation. Blind SQL injection differs from error-based SQL injection in that attackers cannot directly observe query results; instead, they infer data through time-based delays or boolean-based responses, making exploitation more complex but still entirely feasible with proper techniques. The root cause is the direct concatenation of user input into SQL queries rather than using prepared statements or parameterized queries.

RemediationAI

Immediately upgrade JoomSky JS Help Desk to the next available patch release beyond version 3.0.3. Check the official Patchstack vulnerability database at https://patchstack.com/database/Wordpress/Plugin/js-support-ticket/vulnerability/wordpress-js-help-desk-plugin-3-0-3-sql-injection-vulnerability for the specific patch version. Until patching is possible, implement network-level access controls to restrict the plugin to trusted IP ranges, disable the plugin if not actively in use, apply a Web Application Firewall (WAF) rule set with SQL injection detection signatures, and enforce strong database credentials with principle of least privilege (read-only access where possible). Additionally, implement comprehensive database activity monitoring to detect any suspicious query patterns that may indicate exploitation attempts.