CVE-2024-51670 (GCVE-0-2024-51670)

Vulnerability from cvelistv5 – Published: 2024-11-09 13:06 – Updated: 2026-04-01 15:37
VLAI?
Title
WordPress JS Help Desk plugin <= 2.8.7 - Stored Cross Site Scripting (XSS) vulnerability
Summary
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JoomSky JS Help Desk js-support-ticket allows Stored XSS.This issue affects JS Help Desk: from n/a through <= 2.8.7.
Severity ?
No CVSS data available.
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
Vendor Product Version
JoomSky JS Help Desk Affected: 0 , ≤ 2.8.7 (custom)
Create a notification for this product.
Date Public ?
2026-04-01 16:29
Credits
casol | Patchstack Bug Bounty Program
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-51670",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-09T15:21:28.627612Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-09T15:21:48.306Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "js-support-ticket",
          "product": "JS Help Desk",
          "vendor": "JoomSky",
          "versions": [
            {
              "changes": [
                {
                  "at": "2.8.8",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "2.8.7",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "casol | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-04-01T16:29:11.954Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in JoomSky JS Help Desk js-support-ticket allows Stored XSS.\u003cp\u003eThis issue affects JS Help Desk: from n/a through \u003c= 2.8.7.\u003c/p\u003e"
            }
          ],
          "value": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in JoomSky JS Help Desk js-support-ticket allows Stored XSS.This issue affects JS Help Desk: from n/a through \u003c= 2.8.7."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-592",
          "descriptions": [
            {
              "lang": "en",
              "value": "Stored XSS"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-01T15:37:38.979Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/Wordpress/Plugin/js-support-ticket/vulnerability/wordpress-js-help-desk-plugin-2-8-7-stored-cross-site-scripting-xss-vulnerability?_s_id=cve"
        }
      ],
      "title": "WordPress JS Help Desk plugin \u003c= 2.8.7 - Stored Cross Site Scripting (XSS) vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2024-51670",
    "datePublished": "2024-11-09T13:06:15.364Z",
    "dateReserved": "2024-10-30T15:05:38.836Z",
    "dateUpdated": "2026-04-01T15:37:38.979Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027) vulnerability in JS Help Desk JS Help Desk \\u2013 Best Help Desk \u0026 Support Plugin allows Stored XSS.This issue affects JS Help Desk \\u2013 Best Help Desk \u0026 Support Plugin: from n/a through 2.8.7.\"}, {\"lang\": \"es\", \"value\": \"Vulnerabilidad de neutralizaci\\u00f3n incorrecta de la entrada durante la generaci\\u00f3n de p\\u00e1ginas web (XSS o \u0027Cross-site Scripting\u0027) en JS Help Desk JS Help Desk \\u2013 Best Help Desk \u0026amp; Support Plugin permite XSS almacenado. Este problema afecta a JS Help Desk \\u2013 Best Help Desk \u0026amp; Support Plugin: desde n/a hasta 2.8.7.\"}]",
      "id": "CVE-2024-51670",
      "lastModified": "2024-11-12T13:56:24.513",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"audit@patchstack.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L\", \"baseScore\": 5.9, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"LOW\"}, \"exploitabilityScore\": 1.7, \"impactScore\": 3.7}]}",
      "published": "2024-11-09T13:15:05.007",
      "references": "[{\"url\": \"https://patchstack.com/database/vulnerability/js-support-ticket/wordpress-js-help-desk-plugin-2-8-7-stored-cross-site-scripting-xss-vulnerability?_s_id=cve\", \"source\": \"audit@patchstack.com\"}]",
      "sourceIdentifier": "audit@patchstack.com",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": "[{\"source\": \"audit@patchstack.com\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-79\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-51670\",\"sourceIdentifier\":\"audit@patchstack.com\",\"published\":\"2024-11-09T13:15:05.007\",\"lastModified\":\"2026-04-01T16:19:34.660\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in JoomSky JS Help Desk js-support-ticket allows Stored XSS.This issue affects JS Help Desk: from n/a through \u003c= 2.8.7.\"},{\"lang\":\"es\",\"value\":\"Vulnerabilidad de neutralizaci\u00f3n incorrecta de la entrada durante la generaci\u00f3n de p\u00e1ginas web (XSS o \u0027Cross-site Scripting\u0027) en JS Help Desk JS Help Desk \u2013 Best Help Desk \u0026amp; Support Plugin permite XSS almacenado. Este problema afecta a JS Help Desk \u2013 Best Help Desk \u0026amp; Support Plugin: desde n/a hasta 2.8.7.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":4.8,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.7,\"impactScore\":2.7}]},\"weaknesses\":[{\"source\":\"audit@patchstack.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:joomsky:js_help_desk:*:*:*:*:free:wordpress:*:*\",\"versionEndExcluding\":\"2.8.8\",\"matchCriteriaId\":\"48A4EBB1-FC15-4B11-99F1-1CCDBC248D62\"}]}]}],\"references\":[{\"url\":\"https://patchstack.com/database/Wordpress/Plugin/js-support-ticket/vulnerability/wordpress-js-help-desk-plugin-2-8-7-stored-cross-site-scripting-xss-vulnerability?_s_id=cve\",\"source\":\"audit@patchstack.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-51670\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-11-09T15:21:28.627612Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-11-09T15:21:32.992Z\"}}], \"cna\": {\"title\": \"WordPress JS Help Desk plugin \u003c= 2.8.7 - Stored Cross Site Scripting (XSS) vulnerability\", \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"casol | Patchstack Bug Bounty Program\"}], \"impacts\": [{\"capecId\": \"CAPEC-592\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"Stored XSS\"}]}], \"affected\": [{\"vendor\": \"JoomSky\", \"product\": \"JS Help Desk\", \"versions\": [{\"status\": \"affected\", \"changes\": [{\"at\": \"2.8.8\", \"status\": \"unaffected\"}], \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"2.8.7\"}], \"packageName\": \"js-support-ticket\", \"collectionURL\": \"https://wordpress.org/plugins\", \"defaultStatus\": \"unaffected\"}], \"datePublic\": \"2026-04-01T16:29:11.954Z\", \"references\": [{\"url\": \"https://patchstack.com/database/Wordpress/Plugin/js-support-ticket/vulnerability/wordpress-js-help-desk-plugin-2-8-7-stored-cross-site-scripting-xss-vulnerability?_s_id=cve\", \"tags\": [\"vdb-entry\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in JoomSky JS Help Desk js-support-ticket allows Stored XSS.This issue affects JS Help Desk: from n/a through \u003c= 2.8.7.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in JoomSky JS Help Desk js-support-ticket allows Stored XSS.\u003cp\u003eThis issue affects JS Help Desk: from n/a through \u003c= 2.8.7.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-79\", \"description\": \"Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"21595511-bba5-4825-b968-b78d1f9984a3\", \"shortName\": \"Patchstack\", \"dateUpdated\": \"2026-04-01T15:37:38.979Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-51670\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-04-01T15:37:38.979Z\", \"dateReserved\": \"2024-10-30T15:05:38.836Z\", \"assignerOrgId\": \"21595511-bba5-4825-b968-b78d1f9984a3\", \"datePublished\": \"2024-11-09T13:06:15.364Z\", \"assignerShortName\": \"Patchstack\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.