CVE-2026-118046

Name of the Vulnerable Software and Affected Versions JS Help Desk – AI-Powered Support & Ticketing System versions prior to 5.0.3

Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access or higher to perform Stored DOM-Based Cross-Site Scripting. This occurs via the jsticket message parameter. The issue is triggered when an administrator or agent opens a ticket and the page initializes VenoBox, which reads the browser-decoded data-title attribute and passes it to the jQuery .html() function, executing arbitrary web scripts.

Recommendations Update the plugin to a version newer than 5.0.2.