The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to stored cross‑site scripting via ticket subjects in all versions up to 3.3.4. The flaw arises because the plugin does not properly sanitize user input or escape output, allowing an attacker to inject arbitrary web scripts that execute whenever a user accesses a page containing the affected ticket. This vulnerability is categorized as CWE‑79.

All WordPress sites that have installed the ELEX WordPress HelpDesk & Customer Ticketing System plugin from Elextensions, and are running any version up to and including 3.3.4, are affected. Versions beyond 3.3.4 are not known to include this issue.

The CVSS score of 7.2 indicates moderate to high severity. An EPSS score of less than 1% suggests low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Because authentication is not required, the likely attack vector is that an unauthenticated actor creates or modifies a ticket subject containing malicious script tags; any site visitor who browses the affected page will trigger the injected code.