SQL Injection Vulnerability in JS Help Desk Plugin for WordPress
CVE-2023-7337

7.5HIGH

Key Information:

Vendor

WordPress
Status
Js Help Desk – Ai-powered Support & Ticketing System
Vendor
CVE Published:
4 March 2026

What is CVE-2023-7337?

The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress contains an SQL Injection vulnerability that arises from an incomplete fix of a previous issue. Specifically, it affects version 2.8.2 where the 'js-support-ticket-token-tkstatus' cookie allows unauthenticated attackers to manipulate SQL queries. The vulnerability occurs due to inadequate escaping of user-supplied values and insufficient preparation of SQL queries, enabling malicious users to inject additional queries. This exploit can lead to the unauthorized extraction of sensitive information from the database.

Affected Version(s)

JS Help Desk – AI-Powered Support & Ticketing System 0 <= 2.8.2

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset?old_path=/js...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.