The ELEX WordPress HelpDesk & Customer Ticketing System plugin contains a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input in ticket subjects. This allows unauthenticated attackers to inject arbitrary web scripts that execute in the context of users viewing the injected content. The vulnerability affects all versions up to and including 3.3.4. It has a CVSS 3.1 base score of 7.2, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction needed, and impacts confidentiality and integrity with scope change. No patch or official remediation has been documented in the provided data.

Successful exploitation enables an unauthenticated attacker to inject and execute arbitrary scripts in the context of users accessing the affected pages. This can lead to theft of sensitive information such as session tokens, user impersonation, or other client-side impacts compromising confidentiality and integrity. There is no indication of impact to availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling the ELEX WordPress HelpDesk & Customer Ticketing System plugin or restricting access to trusted users only. Avoid exposing the ticket subject input to untrusted users and monitor for suspicious activity related to this plugin.