Ahmad
Monthly
Arbitrary file deletion in the JS Help Desk (JS Support Ticket) WordPress plugin versions 3.1.1 and earlier lets a low-privileged authenticated user (Subscriber, PR:L) delete arbitrary files on the server via path traversal. Because the scope is changed (S:C) and impact is availability-only (A:H), an attacker can remove critical files such as wp-config.php to trigger denial of service or force WordPress into a reinstall/setup state. No public exploit is identified at time of analysis and the issue is not listed in CISA KEV; it was disclosed through Patchstack.
SQL injection in the JS Help Desk WordPress plugin versions 3.0.9 and earlier allows remote unauthenticated attackers to inject arbitrary SQL into backend database queries. The flaw was disclosed via Patchstack and carries a CVSS 9.3 with scope change, meaning successful exploitation can read database contents beyond the plugin's own data. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Unauthenticated arbitrary file upload in the GeekyBot WordPress plugin (versions 1.2.2 and earlier) allows remote attackers to upload arbitrary files, including PHP webshells, to the web server without any authentication. Reported by Patchstack and tracked as EUVD-2026-36981, this issue carries a maximum 10.0 CVSS due to network-reachable exploitation with no privileges, no user interaction, and a scope change leading to full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, though the CWE-434 class is heavily targeted on WordPress plugins and routinely leads to full site compromise once disclosed.
Unauthenticated SQL injection in the GeekyBot WordPress plugin versions 1.2.0 and earlier allows remote attackers to inject arbitrary SQL queries against the WordPress database without any authentication or user interaction. The flaw was disclosed via Patchstack and carries a high CVSS 3.1 score of 9.3 with scope change, indicating impact beyond the plugin's own security context. No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.
Reflected cross-site scripting in the WP Job Portal WordPress plugin (versions up to and including 2.5.1) allows remote attackers to inject arbitrary JavaScript that executes in a victim's browser after they click a crafted link. The flaw has CVSS 7.1 elevated by scope change (S:C), meaning script execution can impact resources beyond the vulnerable component, such as the WordPress admin session. No public exploit identified at time of analysis and no CISA KEV listing.
Blind SQL injection in the WP Job Portal WordPress plugin (versions up to and including 2.5.1) allows remote unauthenticated attackers to manipulate backend database queries by sending crafted input to vulnerable parameters. The flaw carries a CVSS 9.3 rating due to network-reachable, no-privileges, no-user-interaction exploitation with scope change, and no public exploit code has been identified at time of analysis. The vulnerability was reported through Patchstack's WordPress security program, with no CISA KEV listing.
Authenticated low-privilege users can read and modify support tickets they do not own in the JS Help Desk WordPress plugin (Ahmad) through version 4.0.0, due to an insecure direct object reference (CWE-639) that exposes user-controlled ticket identifiers. Rated CVSS 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), exploitation requires a valid low-privilege account and is limited to confidentiality and integrity impact on support-ticket data, with no availability impact. No public exploit identified at time of analysis; no exploit code or KEV listing is referenced in the available intelligence.
Authenticated low-privileged users can read support tickets belonging to other users in the Ahmad JS Help Desk WordPress plugin through version 4.0.0 by manipulating user-controlled object references. This is a classic insecure direct object reference (IDOR, CWE-639) limited to confidentiality impact; authentication is required per the CVSS vector (PR:L), and no public exploit code has been identified at time of analysis. With a CVSS score of 4.3 and no active exploitation reported, this is a moderate-severity, low-priority issue.
Authenticated low-privilege users can bypass authorization checks in the WordPress plugin Majestic Support through version 1.2.0, because the plugin accepts user-controlled object identifiers without verifying ownership or access-level permissions (CWE-639). Successful exploitation is limited to integrity impact-unauthorized changes to other users' support objects-with no confidentiality or availability effect per the assessed CVSS vector, and it requires a valid low-privilege account while the plugin is installed and active. This is a modest-severity authorization flaw rather than an urgent priority; no public exploit code or confirmed active exploitation was identified in the provided intelligence at time of analysis.
Majestic Support plugin through 1.2.0 for WordPress allows remote unauthenticated attackers to perform unauthorized low-integrity actions because a plugin endpoint omits an authorization check. Only integrity is affected, with no confidentiality or availability impact expected, and no public exploit identified at time of analysis.
Subscriber-level Insecure Direct Object Reference (IDOR) in WP Job Portal WordPress plugin versions up to and including 2.5.9 allows low-privilege authenticated users to perform unauthorized modifications to job-related objects belonging to other users. The flaw arises from missing server-side authorization checks on user-controlled object identifiers, enabling a subscriber to target and alter records - such as job applications or listings - that they do not own. No confirmed active exploitation or public exploit code has been identified at time of analysis.
Broken Access Control in the JS Help Desk WordPress plugin version 3.0.9 and earlier enables unauthenticated remote attackers to perform unauthorized actions against the help desk system, impacting both integrity and availability. The flaw, rooted in missing authorization checks (CWE-862), allows network-accessible exploitation with no credentials, no user interaction, and low attack complexity. No public exploit code or CISA KEV listing has been identified at time of analysis, but the trivial exploitation profile warrants prompt remediation on any internet-exposed WordPress deployment.
Stored Cross-Site Scripting in WP Job Portal WordPress plugin versions up to and including 2.5.2 allows authenticated Subscriber-level users to inject persistent malicious JavaScript payloads that execute in other users' browsers, including administrators. The CVSS S:C scope change confirms the injected script crosses the security boundary into victims' browser sessions, enabling session hijacking or unauthorized administrative actions. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low privilege requirement makes this realistic on open-registration WordPress job-board deployments.
Arbitrary file deletion in the JS Help Desk (JS Support Ticket) WordPress plugin versions 3.1.1 and earlier lets a low-privileged authenticated user (Subscriber, PR:L) delete arbitrary files on the server via path traversal. Because the scope is changed (S:C) and impact is availability-only (A:H), an attacker can remove critical files such as wp-config.php to trigger denial of service or force WordPress into a reinstall/setup state. No public exploit is identified at time of analysis and the issue is not listed in CISA KEV; it was disclosed through Patchstack.
SQL injection in the JS Help Desk WordPress plugin versions 3.0.9 and earlier allows remote unauthenticated attackers to inject arbitrary SQL into backend database queries. The flaw was disclosed via Patchstack and carries a CVSS 9.3 with scope change, meaning successful exploitation can read database contents beyond the plugin's own data. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Unauthenticated arbitrary file upload in the GeekyBot WordPress plugin (versions 1.2.2 and earlier) allows remote attackers to upload arbitrary files, including PHP webshells, to the web server without any authentication. Reported by Patchstack and tracked as EUVD-2026-36981, this issue carries a maximum 10.0 CVSS due to network-reachable exploitation with no privileges, no user interaction, and a scope change leading to full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, though the CWE-434 class is heavily targeted on WordPress plugins and routinely leads to full site compromise once disclosed.
Unauthenticated SQL injection in the GeekyBot WordPress plugin versions 1.2.0 and earlier allows remote attackers to inject arbitrary SQL queries against the WordPress database without any authentication or user interaction. The flaw was disclosed via Patchstack and carries a high CVSS 3.1 score of 9.3 with scope change, indicating impact beyond the plugin's own security context. No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.
Reflected cross-site scripting in the WP Job Portal WordPress plugin (versions up to and including 2.5.1) allows remote attackers to inject arbitrary JavaScript that executes in a victim's browser after they click a crafted link. The flaw has CVSS 7.1 elevated by scope change (S:C), meaning script execution can impact resources beyond the vulnerable component, such as the WordPress admin session. No public exploit identified at time of analysis and no CISA KEV listing.
Blind SQL injection in the WP Job Portal WordPress plugin (versions up to and including 2.5.1) allows remote unauthenticated attackers to manipulate backend database queries by sending crafted input to vulnerable parameters. The flaw carries a CVSS 9.3 rating due to network-reachable, no-privileges, no-user-interaction exploitation with scope change, and no public exploit code has been identified at time of analysis. The vulnerability was reported through Patchstack's WordPress security program, with no CISA KEV listing.
Authenticated low-privilege users can read and modify support tickets they do not own in the JS Help Desk WordPress plugin (Ahmad) through version 4.0.0, due to an insecure direct object reference (CWE-639) that exposes user-controlled ticket identifiers. Rated CVSS 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), exploitation requires a valid low-privilege account and is limited to confidentiality and integrity impact on support-ticket data, with no availability impact. No public exploit identified at time of analysis; no exploit code or KEV listing is referenced in the available intelligence.
Authenticated low-privileged users can read support tickets belonging to other users in the Ahmad JS Help Desk WordPress plugin through version 4.0.0 by manipulating user-controlled object references. This is a classic insecure direct object reference (IDOR, CWE-639) limited to confidentiality impact; authentication is required per the CVSS vector (PR:L), and no public exploit code has been identified at time of analysis. With a CVSS score of 4.3 and no active exploitation reported, this is a moderate-severity, low-priority issue.
Authenticated low-privilege users can bypass authorization checks in the WordPress plugin Majestic Support through version 1.2.0, because the plugin accepts user-controlled object identifiers without verifying ownership or access-level permissions (CWE-639). Successful exploitation is limited to integrity impact-unauthorized changes to other users' support objects-with no confidentiality or availability effect per the assessed CVSS vector, and it requires a valid low-privilege account while the plugin is installed and active. This is a modest-severity authorization flaw rather than an urgent priority; no public exploit code or confirmed active exploitation was identified in the provided intelligence at time of analysis.
Majestic Support plugin through 1.2.0 for WordPress allows remote unauthenticated attackers to perform unauthorized low-integrity actions because a plugin endpoint omits an authorization check. Only integrity is affected, with no confidentiality or availability impact expected, and no public exploit identified at time of analysis.
Subscriber-level Insecure Direct Object Reference (IDOR) in WP Job Portal WordPress plugin versions up to and including 2.5.9 allows low-privilege authenticated users to perform unauthorized modifications to job-related objects belonging to other users. The flaw arises from missing server-side authorization checks on user-controlled object identifiers, enabling a subscriber to target and alter records - such as job applications or listings - that they do not own. No confirmed active exploitation or public exploit code has been identified at time of analysis.
Broken Access Control in the JS Help Desk WordPress plugin version 3.0.9 and earlier enables unauthenticated remote attackers to perform unauthorized actions against the help desk system, impacting both integrity and availability. The flaw, rooted in missing authorization checks (CWE-862), allows network-accessible exploitation with no credentials, no user interaction, and low attack complexity. No public exploit code or CISA KEV listing has been identified at time of analysis, but the trivial exploitation profile warrants prompt remediation on any internet-exposed WordPress deployment.
Stored Cross-Site Scripting in WP Job Portal WordPress plugin versions up to and including 2.5.2 allows authenticated Subscriber-level users to inject persistent malicious JavaScript payloads that execute in other users' browsers, including administrators. The CVSS S:C scope change confirms the injected script crosses the security boundary into victims' browser sessions, enabling session hijacking or unauthorized administrative actions. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low privilege requirement makes this realistic on open-registration WordPress job-board deployments.