Threat database

Authorization Bypass Through User-Controlled Key vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through 4.0.0.

Authorization Bypass Through User-Controlled Key vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through 4.0.0.

Authorization Bypass Through User-Controlled Key vulnerability in Ahmad Majestic Support majestic-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Majestic Support: from n/a through 1.2.0.

Missing Authorization vulnerability in Ahmad Majestic Support majestic-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Majestic Support: from n/a through 1.2.0.

CVE-2026-81299 is a medium severity vulnerability in Ahmad WP Job Portal versions up to 2.5.9. It involves an Insecure Direct Object Reference (IDOR) that allows authorization bypass through a user-controlled key, classified under CWE-639. This flaw could allow an attacker with limited privileges to perform unauthorized actions or access data by manipulating keys. No official patch or remediation guidance is currently available from the vendor.

Unauthenticated Cross Site Scripting (XSS) in GeekyBot <= 1.2.6 versions.

The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin for WordPress is vulnerable to generic SQL Injection via the 'val' parameter in all versions up to, and including, 1.1.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires a valid 'get-smart-reply' nonce, which any Subscriber-level user can obtain by creating a ticket via the public frontend and visiting the resulting ticket detail page, making this effectively exploitable by any authenticated user.

Unauthenticated SQL Injection in GeekyBot <= 1.2.5 versions.

Subscriber Arbitrary File Deletion in JS Help Desk <= 3.1.1 versions.

Unauthenticated Broken Access Control in JS Help Desk <= 3.0.9 versions.

Unauthenticated SQL Injection in JS Help Desk <= 3.0.9 versions.

CVE-2026-48880 is a cross-site scripting (XSS) vulnerability affecting WP Job Portal versions up to and including 2.5.2. The issue involves improper neutralization of input during web page generation, allowing subscriber-level users to inject malicious scripts. This vulnerability has a medium severity rating with a CVSS score of 6.5. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.

CVE-2026-40772 is a critical vulnerability in Ahmad's GeekyBot software versions up to and including 1.2.2. It allows unauthenticated attackers to upload arbitrary files of dangerous types, leading to complete compromise of confidentiality, integrity, and availability. The vulnerability is classified as CWE-434, indicating unrestricted file upload. No official patch or remediation guidance is currently available.

Unauthenticated SQL Injection in GeekyBot <= 1.2.0 versions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ahmad WP Job Portal allows Reflected XSS. This issue affects WP Job Portal: from n/a through 2.5.1.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ahmad WP Job Portal allows Blind SQL Injection. This issue affects WP Job Portal: from n/a through 2.5.1.

The Geeky Bot plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.2.2. This is due to a nopriv AJAX route allowing attacker-controlled model/function dispatch and reaching a plugin installer helper that downloads and unzips attacker-supplied ZIP files into wp-content/plugins/. This makes it possible for unauthenticated attackers to perform arbitrary plugin installation and achieve remote code execution.

CVE-2026-3456 is a high-severity SQL Injection vulnerability in the GeekyBot WordPress plugin (versions up to 1.2.0). It arises from improper neutralization of special elements in the 'attributekey' parameter, allowing unauthenticated attackers to inject additional SQL queries. This can lead to unauthorized extraction of sensitive database information. No official patch or remediation guidance is currently available from the vendor. The vulnerability does not affect cloud services and no known exploits are reported in the wild.

The GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the chat message field in all versions up to, and including, 1.1.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrator accesses the Chat History page.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ahmad Awais WP Super Edit wp-super-edit allows Reflected XSS.This issue affects WP Super Edit: from n/a through <= 2.5.4.