What’s Vulnerable › Products

Elula Wsdesk vulnerabilities

10 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 10 published in the last 12 months.

Check whether your Elula Wsdesk version is affected

Latest Elula Wsdesk vulnerabilities

• CVE-2025-13534 — ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.2 - Authenticated (Contributor+) Privilege Escalation via eh_crm_edit_agent AJAX Action (CVSS 8.8)
• CVE-2025-10054 — ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Role Removal (CVSS 4.3)
• CVE-2025-10039 — ELEX WordPress HelpDesk & Customer Ticketing System <= 3.2.9 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'eh_crm_ticket_single_view_client' (CVSS 4.3)
• CVE-2025-11456 — ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Unauthenticated Arbitrary File Upload (CVSS 9.8)
• CVE-2025-12169 — ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.0 - Missing Authorization to Authenitcated (Subscriber+) to Scheduled Trigger Deletion (CVSS 4.3)
• CVE-2025-12085 — ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Trash Empty (CVSS 4.3)
• CVE-2025-12023 — ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Ticket Restore (CVSS 4.3)
• CVE-2025-12022 — ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Trash Restore (CVSS 4.3)
• CVE-2025-47658 — WordPress ELEX HelpDesk & Customer Ticketing System plugin <= 3.2.9 - Arbitrary File Upload vulnerability (CVSS 8.8)
• CVE-2024-12171 — ELEX WordPress HelpDesk & Customer Ticketing System <= 3.2.6 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation (CVSS 8.8)