CVE-2026-14929
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
The JS Help Desk WordPress plugin before version 3.1.4 does not verify ownership of a reply before updating it. Any authenticated user (Subscriber and above) can overwrite the content of any support-ticket reply.
Risk Assessment
Low-privileged users can alter support replies, potentially causing misinformation or hiding critical information.
Recommendation
Update the JS Help Desk plugin to version 3.1.4 or later, which includes ownership verification before updating replies.
Other vulnerabilities in JS Help Desk WordPress plugin
See all- CVE-2026-14930High
The JS Help Desk WordPress plugin before version 3.1.4 lacks authorization and ownership checks in file upload requests. Unauthenticated users can upload files (with allowed extensions) and attach them to any user's support tickets.
- CVE-2026-14928Medium
The JS Help Desk WordPress plugin before version 3.1.4 lacks authorization and ownership checks when returning ticket content in a nonce-gated search handler. Any authenticated user (Subscriber and above) can read the subject and full message body of all other users' support tickets.
Original NVD description (English source)
The JS Help Desk WordPress plugin before 3.1.4 does not verify ownership of the targeted reply before updating it, allowing any authenticated user (Subscriber and above) to overwrite the content of any support-ticket reply on the site.