CVE-2025-9343

ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.4 - Unauthenticated Stored Cross-Site Scripting

Published Dec 21, 2025 CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Description

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via ticket subjects in all versions up to, and including, 3.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Analysis

Technical impact

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to stored cross‑site scripting via ticket subjects in all versions up to 3.3.4. The flaw arises because the plugin does not properly sanitize user input or escape output, allowing an attacker to inject arbitrary web scripts that execute whenever a user accesses a page containing the affected ticket. This vulnerability is categorized as CWE‑79.

Affected Systems

All WordPress sites that have installed the ELEX WordPress HelpDesk & Customer Ticketing System plugin from Elextensions, and are running any version up to and including 3.3.4, are affected. Versions beyond 3.3.4 are not known to include this issue.

Risk and Exploitability

The CVSS score of 7.2 indicates moderate to high severity. An EPSS score of less than 1% suggests low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Because authentication is not required, the likely attack vector is that an unauthenticated actor creates or modifies a ticket subject containing malicious script tags; any site visitor who browses the affected page will trigger the injected code.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

elextensions

ELEX WordPress HelpDesk & Customer Ticketing System

unaffected

Version	Status	Constraints
`0`	affected	≤ 3.3.4

No data.

Vendor	Product	Versions
Elextensions	Elex Wordpress Plugin	—
Wordpress	Wordpress	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Install the latest release of the ELEX plugin that removes the XSS flaw (i.e., a version greater than 3.3.4).
If an upgraded version is unavailable, apply server‑side sanitization to ticket subject fields and escape all output, for example by using a WordPress filter such as wp_strip_all_tags before storing or displaying the data.
As a temporary measure, disable guest‑user ticket submission or restrict ticket creation to authenticated users until a secure version is deployed.

Generated by OpenCVE AI on April 22, 2026 at 16:02 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.226% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3420695%40elex-helpdesk-customer-support-ticket-system&new=3420695%40elex-helpdesk-customer-support-ticket-system&sfp_email=&sfph_mail=
https://www.wordfence.com/threat-intel/vulnerabilities/id/042d9bc7-50ea-4585-9789-b10ed40b0d14?source=cve

History

Dec 23, 2025 11:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Elextensions Elextensions elex Wordpress Plugin Wordpress Wordpress wordpress
Vendors & Products		Elextensions Elextensions elex Wordpress Plugin Wordpress Wordpress wordpress

Dec 22, 2025 5:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Dec 21, 2025 4:00 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via ticket subjects in all versions up to, and including, 3.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Title		ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.4 - Unauthenticated Stored Cross-Site Scripting
Weaknesses		CWE-79
References		https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3420695%40elex-helpdesk-customer-support-ticket-system&new=3420695%40elex-helpdesk-customer-support-ticket-system&sfp_email=&sfph_mail= https://www.wordfence.com/threat-intel/vulnerabilities/id/042d9bc7-50ea-4585-9789-b10ed40b0d14?source=cve
Metrics		cvssV3_1 `{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N'}`