CVE-2026-2511

The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to SQL Injection via the `multiformid` parameter in the `storeTickets()` function in all versions up to, and including, 3.0.4. This is due to the user-supplied `multiformid` value being passed to `esc_sql()` without enclosing the result in quotes in the SQL query, rendering the escaping ineffective against payloads that do not contain quote characters. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

• CWE-89

• https://plugins.trac.wordpress.org/browser/js-support-ticket/tags/3.0.4/modules/fieldordering/model.php#L181
• https://plugins.trac.wordpress.org/browser/js-support-ticket/tags/3.0.4/modules/fieldordering/model.php#L996
• https://plugins.trac.wordpress.org/browser/js-support-ticket/tags/3.0.4/modules/ticket/model.php#L1178
• https://plugins.trac.wordpress.org/changeset/3463031/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/2959c04a-70bd-4f5c-a61a-1eab2609f8ef?source=cve

Published

Mar 26, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-25101Bludit allows user's session identifier to be set before aut…9.8
• CVE-2026-25104MediaArea MediaInfoLib LXF parsing heap-based buffer overflo…7.8
• CVE-2026-25105An OS command injection vulnerability exists in XWEB P…8.8
• CVE-2026-25107ELECOM wireless LAN access point devices use a hard-coded cr…6.9
• CVE-2026-25108FileZen contains an OS command injection vulnerability. When…8.8
• CVE-2026-25109An OS command injection vulnerability exists in XWEB Pro …8.8
• CVE-2026-25110in OpenHarmony v6.0 and prior versions allow a local attacke…3.3
• CVE-2026-25111An OS command injection vulnerability exists in XWEB Pro ve…8.8
• CVE-2026-25112A high-severity vulnerability in the deployment of Genetec R…7.8
• CVE-2026-25113The WebSocket Application Programming Interface lacks restri…9.8
• CVE-2026-25114The WebSocket Application Programming Interface lacks restri…9.8
• CVE-2026-25115n8n is an open source workflow automation platform. Prior to…9.9