Skip to content
OpenAdvisories

Product · ELEXtensions

ELEX WordPress HelpDesk & Customer Ticketing System

18 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-119077 Public exploit

    ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.9 - Unauthenticated PHP Object Injection to Remote Code Execution via 'form' Parameter

    The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.3.9 via the 'form (specifically the attacker-controlled ticket_label field inside the url-encoded form s…

    ELEXtensions ELEX WordPress HelpDesk & Customer Ticketing System Web / CMS
  • Critical 9.1
    CVE-2026-114630 Public exploit

    ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.8 - Unauthenticated Arbitrary File Deletion via 'ticket_attachment_path' Parameter

    The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the factory_reset function in all versions up to, and including, 3.3.8 This makes it possible for…

    ELEXtensions ELEX WordPress HelpDesk & Customer Ticketing System Web / CMS