Improperly sanitized input in the JoomSky JS Help Desk plugin allows blind SQL injection. The vulnerability can let an attacker extract or modify sensitive data stored in the plugin’s database, potentially including user credentials and site content. The failure to neutralize special characters in SQL statements is a classic instance of CWE‑89, directly exposing the application to adversarial data manipulation.

WordPress sites running the JoomSky JS Help Desk plugin version 3.0.1 or earlier are affected. The plugin is distributed under the JoomSky brand and is integrated into WordPress sites via the js-support-ticket installation.

The CVSS score of 8.5 classifies this as a high‑severity flaw, and an EPSS score below 1% indicates that the probability of exploitation is currently low. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is an external web request – an attacker can target the plugin’s input handling over HTTP to trigger the blind SQL injection. The absence of an error message means the attack would be conducted by inferring data from response patterns, requiring a certain level of skill but providing significant confidentiality and integrity impact if successful.