ELEXtensions vulnerabilities

CVEs per yearBy the year they were published

1. 20244
2. 202519
3. 20266

Newest CVEs

• CVE-2026-103768

  ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.7 - Unauthenticated Arbitrary File Upload via IMAP Email Attachment

  elextensions · ELEX WordPress HelpDesk & Customer Ticketing System

  Critical9.8
• CVE-2026-103083

  WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin <= 1.5.3 - Insecure Direct Object References (IDOR) vulnerability

  ELEXtensions · ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes

  Medium5.4
• CVE-2026-40800

  WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin <= 1.5.3 - SQL Injection vulnerability

  ELEXtensions · ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes

  Critical9.3
• CVE-2026-48964

  WordPress ELEX WordPress HelpDesk & Customer Ticketing System plugin <= 3.3.6 - SQL Injection vulnerability

  ELEXtensions · ELEX WordPress HelpDesk & Customer Ticketing System

  High8.5
• CVE-2025-68837

  WordPress ELEX WordPress HelpDesk & Customer Ticketing System plugin <= 3.3.5 - Broken Access Control vulnerability

  ELEXtensions · ELEX WordPress HelpDesk & Customer Ticketing System

  Medium6.5
• CVE-2025-14079

  ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.5 - Missing Authorization to Authenticated (Subscriber+) Settings Update

  elextensions · ELEX WordPress HelpDesk & Customer Ticketing System

  Medium5.3
• CVE-2025-9343

  ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.4 - Unauthenticated Stored Cross-Site Scripting

  elextensions · ELEX WordPress HelpDesk & Customer Ticketing System

  High7.2
• CVE-2025-13534

  ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.2 - Authenticated (Contributor+) Privilege Escalation via eh_crm_edit_agent AJAX Action

  elextensions · ELEX WordPress HelpDesk & Customer Ticketing System

  Medium6.3
• CVE-2025-10039

  ELEX WordPress HelpDesk & Customer Ticketing System <= 3.2.9 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'eh_crm_ticket_single_view_client'

  elextensions · ELEX WordPress HelpDesk & Customer Ticketing System

  Medium4.3
• CVE-2025-10054

  ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Role Removal

  elextensions · ELEX WordPress HelpDesk & Customer Ticketing System

  Medium4.3