Elextensions vulnerabilities

Products

• Elex Wordpress Helpdesk & Customer Ticketing System 16
• Elex Woocommerce Advanced Bulk Edit Products, Prices & Attributes 4
• Elex Woocommerce Dynamic Pricing And Discounts 4
• Elex Woocommerce Request A Quote 2

Newest

• elextensions elex wordpress helpdesk & customer ticketing system ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.8 - Unauthenticated Arbitrary File Deletion via 'ticket_attachment_path' Parameter CVE-2026-114630 Public exploit 9.1 CriticalNovember 6, 2026
• elextensions elex wordpress helpdesk & customer ticketing system ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.7 - Unauthenticated Arbitrary File Upload via IMAP Email Attachment CVE-2026-103768 9.8 CriticalOctober 16, 2026
• elextensions elex woocommerce advanced bulk edit products, prices & attributes WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin <= 1.5.3 - Insecure Direct Object References (IDOR) vulnerability CVE-2026-103083 5.4 MediumOctober 15, 2026
• elextensions elex woocommerce advanced bulk edit products, prices & attributes WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin <= 1.5.3 - SQL Injection vulnerability CVE-2026-40800 9.3 CriticalOctober 10, 2026
• elextensions elex woocommerce request a quote ELEX WooCommerce Request a Quote < 2.4.1 - Unauthenticated SQLi via variation_id CVE-2026-14962 8.6 HighSeptember 9, 2026
• elextensions elex wordpress helpdesk & customer ticketing system WordPress ELEX WordPress HelpDesk & Customer Ticketing System plugin <= 3.3.6 - SQL Injection vulnerability CVE-2026-48964 8.5 HighJune 15, 2026
• elextensions elex wordpress helpdesk & customer ticketing system WordPress ELEX WordPress HelpDesk & Customer Ticketing System plugin <= 3.3.5 - Broken Access Control vulnerability CVE-2025-68837 6.5 MediumFebruary 20, 2026
• elextensions elex wordpress helpdesk & customer ticketing system ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.5 - Missing Authorization to Authenticated (Subscriber+) Settings Update CVE-2025-14079 5.3 MediumFebruary 5, 2026
• elextensions elex wordpress helpdesk & customer ticketing system ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.4 - Unauthenticated Stored Cross-Site Scripting CVE-2025-9343 7.2 HighDecember 21, 2025
• elextensions elex wordpress helpdesk & customer ticketing system, elula wsdesk +1 more ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.2 - Authenticated (Contributor+) Privilege Escalation via eh_crm_edit_agent AJAX Action CVE-2025-13534 6.3 MediumDecember 2, 2025
• elextensions elex wordpress helpdesk & customer ticketing system, elula wsdesk +1 more ELEX WordPress HelpDesk & Customer Ticketing System <= 3.2.9 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'eh_crm_ticket_single_view_client' CVE-2025-10039 4.3 MediumNovember 21, 2025
• elextensions elex wordpress helpdesk & customer ticketing system, elula wsdesk +1 more ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Role Removal CVE-2025-10054 4.3 MediumNovember 21, 2025
• elextensions elex wordpress helpdesk & customer ticketing system, elula wsdesk +1 more ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Unauthenticated Arbitrary File Upload CVE-2025-11456 9.8 CriticalNovember 21, 2025
• elextensions elex wordpress helpdesk & customer ticketing system, elula wsdesk +1 more ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.0 - Missing Authorization to Authenitcated (Subscriber+) to Scheduled Trigger Deletion CVE-2025-12169 4.3 MediumNovember 21, 2025
• elextensions elex wordpress helpdesk & customer ticketing system, elula wsdesk +1 more ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Trash Restore CVE-2025-12022 4.3 MediumNovember 21, 2025
• elextensions elex wordpress helpdesk & customer ticketing system, elula wsdesk +1 more ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Trash Empty CVE-2025-12085 4.3 MediumNovember 21, 2025
• elextensions elex wordpress helpdesk & customer ticketing system, elula wsdesk +1 more ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Ticket Restore CVE-2025-12023 4.3 MediumNovember 21, 2025
• elextensions wschat – wordpress live chat WSChat – WordPress Live Chat <= 3.1.6 - Missing Authorization to Authenticated (Subscriber+) Settings Reset CVE-2025-12751 4.3 MediumNovember 19, 2025
• elextensions elex woocommerce google shopping (google product feed) ELEX WooCommerce Google Shopping (Google Product Feed) <= 1.4.3 - Authenticated (Admin+) SQL Inejction CVE-2025-10046 Public exploit 4.9 MediumSeptember 6, 2025
• elextensions reachship woocommerce multi-carrier & conditional shipping WordPress ReachShip WooCommerce Multi-Carrier & Conditional Shipping <= 4.3.1 - Arbitrary File Upload Vulnerability CVE-2025-53213 9.9 CriticalAugust 20, 2025
• elextensions elex woocommerce advanced bulk edit products, prices & attributes WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin <= 1.4.9 - Subscriber+ SQL Injection vulnerability CVE-2025-47645 8.5 HighJuly 16, 2025
• elextensions elex wordpress helpdesk & customer ticketing system, elula wsdesk +1 more WordPress ELEX HelpDesk & Customer Ticketing System plugin <= 3.2.9 - Arbitrary File Upload vulnerability CVE-2025-47658 9.9 CriticalMay 23, 2025
• elextensions elex product feed for woocommerce WordPress ELEX Product Feed for WooCommerce <= 3.1.2 - SQL Injection Vulnerability CVE-2025-47643 7.6 HighMay 7, 2025
• elextensions elex woocommerce bulk edit products, prices & attributes (basic) ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes <= 1.4.9 - Authenticated (Subscriber+) SQL Injection CVE-2025-3280 6.5 MediumApril 24, 2025
• elextensions elex woocommerce request a quote WordPress ELEX WooCommerce Request a Quote plugin <= 2.3.9 - Broken Access Control vulnerability CVE-2025-31406 4.3 MediumMarch 31, 2025
• elextensions elex wordpress helpdesk & customer ticketing system, elula wsdesk +1 more ELEX WordPress HelpDesk & Customer Ticketing System <= 3.2.6 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation CVE-2024-12171 8.8 HighFebruary 1, 2025
• elextensions elex woocommerce advanced bulk edit products, prices & attributes WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes Plugin <= 1.4.9 - SQL Injection vulnerability CVE-2025-22352 Public exploit 7.6 HighJanuary 7, 2025
• elextensions elex woocommerce dynamic pricing and discounts ELEX WooCommerce Dynamic Pricing and Discounts <= 2.1.7 - Missing Authorization CVE-2024-12266 6.5 MediumDecember 24, 2024
• elextensions elex woocommerce dynamic pricing and discounts WordPress ELEX WooCommerce Dynamic Pricing and Discounts plugin <= 2.1.2 - Cross Site Request Forgery (CSRF) vulnerability CVE-2024-31364 4.3 MediumApril 12, 2024
• elextensions elex woocommerce dynamic pricing and discounts WordPress ELEX WooCommerce Dynamic Pricing and Discounts plugin <= 2.1.2 - Cross Site Request Forgery (CSRF) vulnerability CVE-2024-32105 4.3 MediumApril 11, 2024
• elextensions elex woocommerce dynamic pricing and discounts WordPress ELEX WooCommerce Dynamic Pricing and Discounts plugin <= 2.1.2 - Cross Site Scripting (XSS) vulnerability CVE-2024-31255 7.1 HighApril 7, 2024