PT-2026-22897 · WordPress · Js Help Desk – Ai-Powered Support & Ticketing System

Published 2026-03-04 · Updated 2026-03-12 · CVE-2023-7337

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress version 2.8.2

Description The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is susceptible to SQL Injection through the js-support-ticket-token-tkstatus cookie. This is due to an incomplete fix for a previous issue, leaving a second sink with insufficient escaping of user-supplied values and inadequate preparation of the existing SQL query. This allows unauthenticated attackers to append additional SQL queries to existing queries, potentially extracting sensitive information from the database.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2023-7337

Affected Products

Js Help Desk – Ai-Powered Support & Ticketing System

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2023-7337 · Security Note
• https://twitter.com/infoflowcloud/status/2029161409683030121 · Twitter Post
• https://t.me/CVEtracker/46304 · Telegram Post
• https://twitter.com/pdnuclei_bot/status/2032048990632685737 · Twitter Post
• https://t.me/cveNotify/154095 · Telegram Post
• https://twitter.com/CVEnew/status/2029159935876186401 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/b841531b-8728-4933-b3c4-d4e10cbdca79?source=cve · Note
• https://twitter.com/VulmonFeeds/status/2029233960585240774 · Twitter Post
• https://twitter.com/CVEarity/status/2029203776486400037 · Twitter Post
• https://plugins.trac.wordpress.org/changeset?old_path=/js-support-ticket/tags/2.8.2&new_path=/js-support-ticket/tags/2.8.3 · Note