Skip to content
OpenAdvisories

Vendor

ELEXtensions

30 known vulnerabilities.

Products

ELEX WordPress HelpDesk & Customer Ticketing System 16 ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes 4 ELEX WooCommerce Dynamic Pricing and Discounts 4 ELEX WooCommerce Bulk Edit Products, Prices & Attributes (Basic) 1 ELEX Product Feed for WooCommerce 1 ELEX WooCommerce Google Shopping (Google Product Feed) 1 WSChat – WordPress Live Chat 1 ELEX WooCommerce Request a Quote 1 ReachShip WooCommerce Multi-Carrier & Conditional Shipping 1
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-114630 Public exploit

    ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.8 - Unauthenticated Arbitrary File Deletion via 'ticket_attachment_path' Parameter

    The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the factory_reset function in all versions up to, and including, 3.3.8 This makes it possible for…

    ELEXtensions ELEX WordPress HelpDesk & Customer Ticketing System Web / CMS
  • Critical 9.8
    CVE-2026-103768

    ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.7 - Unauthenticated Arbitrary File Upload via IMAP Email Attachment

    The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.3.7 via the initMailPart function. This is due to insufficient file type validation when saving IMAP em…

    ELEXtensions ELEX WordPress HelpDesk & Customer Ticketing System Web / CMS
  • Critical 9.3
    CVE-2026-40800

    WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin <= 1.5.3 - SQL Injection vulnerability

    Subscriber SQL Injection in ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes <= 1.5.3 versions.

    ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes Web / CMS
  • Critical 9.8
    CVE-2025-11456

    ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Unauthenticated Arbitrary File Upload

    The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the eh_crm_new_ticket_post() function in all versions up to, and including, 3.3.1. This makes it possib…

    ELEXtensions ELEX WordPress HelpDesk & Customer Ticketing System Web / CMS
  • Critical 9.9
    CVE-2025-53213

    WordPress ReachShip WooCommerce Multi-Carrier & Conditional Shipping <= 4.3.1 - Arbitrary File Upload Vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in ELEXtensions ReachShip WooCommerce Multi-Carrier & Conditional Shipping elex-reachship-multi-carrier-conditional-shipping allows Using Malicious Files.This issue affects ReachShip WooCommerce Mu…

    ELEXtensions ReachShip WooCommerce Multi-Carrier & Conditional Shipping Web / CMS
  • Critical 9.9
    CVE-2025-47658

    WordPress ELEX HelpDesk & Customer Ticketing System plugin <= 3.2.9 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in ELEXtensions ELEX WordPress HelpDesk & Customer Ticketing System elex-helpdesk-customer-support-ticket-system allows Upload a Web Shell to a Web Server.This issue affects ELEX WordPress HelpDesk…

    ELEXtensions ELEX WordPress HelpDesk & Customer Ticketing System Web / CMS