Skip to content
OpenAdvisories

Vendor

ELEXtensions

30 known vulnerabilities.

Products

ELEX WordPress HelpDesk & Customer Ticketing System 16 ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes 4 ELEX WooCommerce Dynamic Pricing and Discounts 4 ELEX WooCommerce Bulk Edit Products, Prices & Attributes (Basic) 1 ELEX Product Feed for WooCommerce 1 ELEX WooCommerce Google Shopping (Google Product Feed) 1 WSChat – WordPress Live Chat 1 ELEX WooCommerce Request a Quote 1 ReachShip WooCommerce Multi-Carrier & Conditional Shipping 1
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 8.5
    CVE-2026-48964

    WordPress ELEX WordPress HelpDesk & Customer Ticketing System plugin <= 3.3.6 - SQL Injection vulnerability

    Subscriber SQL Injection in ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.6 versions.

    ELEXtensions ELEX WordPress HelpDesk & Customer Ticketing System Web / CMS
  • High 7.2
    CVE-2025-9343

    ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.4 - Unauthenticated Stored Cross-Site Scripting

    The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via ticket subjects in all versions up to, and including, 3.3.4 due to insufficient input sanitization and output escaping. This makes it…

    ELEXtensions ELEX WordPress HelpDesk & Customer Ticketing System Web / CMS
  • High 8.5
    CVE-2025-47645

    WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin <= 1.4.9 - Subscriber+ SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes elex-bulk-edit-products-prices-attributes-for-woocommerce-basic allows SQL Inj…

    ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes Web / CMS
  • High 7.6
    CVE-2025-47643

    WordPress ELEX Product Feed for WooCommerce <= 3.1.2 - SQL Injection Vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ELEXtensions ELEX Product Feed for WooCommerce allows SQL Injection. This issue affects ELEX Product Feed for WooCommerce: from n/a through 3.1.2.

    ELEXtensions ELEX Product Feed for WooCommerce Web / CMS
  • High 8.8
    CVE-2024-12171

    ELEX WordPress HelpDesk & Customer Ticketing System <= 3.2.6 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation

    The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the 'eh_crm_agent_add_user' AJAX action in all versions up to, and including, 3.2.6. This makes it possible…

    ELEXtensions ELEX WordPress HelpDesk & Customer Ticketing System Web / CMS
  • High 7.6
    CVE-2025-22352 Public exploit

    WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes Plugin <= 1.4.9 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes elex-bulk-edit-products-prices-attributes-for-woocommerce-basic allows Blind S…

    ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes Web / CMS
  • High 7.1
    CVE-2024-31255

    WordPress ELEX WooCommerce Dynamic Pricing and Discounts plugin <= 2.1.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ELEXtensions ELEX WooCommerce Dynamic Pricing and Discounts allows Reflected XSS.This issue affects ELEX WooCommerce Dynamic Pricing and Discounts: from n/a …

    ELEXtensions ELEX WooCommerce Dynamic Pricing and Discounts Web / CMS