The vulnerability allows attackers with authenticated subscriber‑tier access to store malicious JavaScript via the jsticket_message field. The script is later rendered unsafely by the VenoBox component, which decodes the data‑title attribute and injects it into the page’s HTML. The stored payload triggers when an administrator or agent opens the affected ticket, allowing the attacker to execute code in the context of the ticket‑review page. This compromises confidentiality and integrity of user sessions and may enable credential theft, defacement or further lateral movement.

Affected products are the WordPress plugin JS Help Desk – AI‑Powered Support & Ticketing System, version 5.0.2 and all earlier releases. The vulnerability exists in the ticket handling code that processes the jsticket_message field and in the VenoBox JavaScript included in the plugin. Only users running these versions are at risk; upgraded installations (5.0.3+) have removed the flaw.

The CVSS score of 6.4 indicates a moderate severity and the lack of an EPSS score leaves the exact exploitation probability uncertain; however, the flaw requires only an authenticated subscriber‑level account, which is commonly available to legitimate users. Because the stored payload runs when privileged users view the ticket, the impact can be significant for sites with many agents, but the cost of an attack is lower than remote code execution. The vulnerability is not listed in CISA’s KEV catalog, so it may not yet be actively exploited in the wild.