# cve.now: Elextensions

The newest entries naming Elextensions as an affected vendor (up to 200), of 30 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-114630](https://cve.now/CVE-2026-114630.md): ELEX WordPress HelpDesk & Customer Ticketing System \<= 3.3.8 - Unauthenticated Arbitrary File Deletion via 'ticket\_attachment\_path'… (CVSS 9.1)
- [CVE-2026-103768](https://cve.now/CVE-2026-103768.md): ELEX WordPress HelpDesk & Customer Ticketing System \<= 3.3.7 - Unauthenticated Arbitrary File Upload via IMAP Email Attachment (CVSS 9.8)
- [CVE-2026-103083](https://cve.now/CVE-2026-103083.md): WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin \<= 1.5.3 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.4)
- [CVE-2026-40800](https://cve.now/CVE-2026-40800.md): WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin \<= 1.5.3 - SQL Injection vulnerability (CVSS 9.3)
- [CVE-2026-48964](https://cve.now/CVE-2026-48964.md): WordPress ELEX WordPress HelpDesk & Customer Ticketing System plugin \<= 3.3.6 - SQL Injection vulnerability (CVSS 8.5)
- [CVE-2025-68837](https://cve.now/CVE-2025-68837.md): WordPress ELEX WordPress HelpDesk & Customer Ticketing System plugin \<= 3.3.5 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2025-14079](https://cve.now/CVE-2025-14079.md): ELEX WordPress HelpDesk & Customer Ticketing System \<= 3.3.5 - Missing Authorization to Authenticated (Subscriber+) Settings Update (CVSS 5.3)
- [CVE-2025-9343](https://cve.now/CVE-2025-9343.md): ELEX WordPress HelpDesk & Customer Ticketing System \<= 3.3.4 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2)
- [CVE-2025-13534](https://cve.now/CVE-2025-13534.md): ELEX WordPress HelpDesk & Customer Ticketing System \<= 3.3.2 - Authenticated (Contributor+) Privilege Escalation via eh\_crm\_edit\_agent AJAX Action (CVSS 6.3)
- [CVE-2025-10039](https://cve.now/CVE-2025-10039.md): ELEX WordPress HelpDesk & Customer Ticketing System \<= 3.2.9 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'eh\_crm\_ticket\_single\_view\_client' (CVSS 4.3)
- [CVE-2025-10054](https://cve.now/CVE-2025-10054.md): ELEX WordPress HelpDesk & Customer Ticketing System \<= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Role Removal (CVSS 4.3)
- [CVE-2025-11456](https://cve.now/CVE-2025-11456.md): ELEX WordPress HelpDesk & Customer Ticketing System \<= 3.3.1 - Unauthenticated Arbitrary File Upload (CVSS 9.8)
- [CVE-2025-12169](https://cve.now/CVE-2025-12169.md): ELEX WordPress HelpDesk & Customer Ticketing System \<= 3.3.0 - Missing Authorization to Authenitcated (Subscriber+) to Scheduled Trigger Deletion (CVSS 4.3)
- [CVE-2025-12022](https://cve.now/CVE-2025-12022.md): ELEX WordPress HelpDesk & Customer Ticketing System \<= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Trash Restore (CVSS 4.3)
- [CVE-2025-12085](https://cve.now/CVE-2025-12085.md): ELEX WordPress HelpDesk & Customer Ticketing System \<= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Trash Empty (CVSS 4.3)
- [CVE-2025-12023](https://cve.now/CVE-2025-12023.md): ELEX WordPress HelpDesk & Customer Ticketing System \<= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Ticket Restore (CVSS 4.3)
- [CVE-2025-12751](https://cve.now/CVE-2025-12751.md): WSChat – WordPress Live Chat \<= 3.1.6 - Missing Authorization to Authenticated (Subscriber+) Settings Reset (CVSS 4.3)
- [CVE-2025-10046](https://cve.now/CVE-2025-10046.md): ELEX WooCommerce Google Shopping (Google Product Feed) \<= 1.4.3 - Authenticated (Admin+) SQL Inejction (CVSS 4.9)
- [CVE-2025-53213](https://cve.now/CVE-2025-53213.md): WordPress ReachShip WooCommerce Multi-Carrier & Conditional Shipping \<= 4.3.1 - Arbitrary File Upload Vulnerability (CVSS 9.9)
- [CVE-2025-47645](https://cve.now/CVE-2025-47645.md): WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin \<= 1.4.9 - Subscriber+ SQL Injection vulnerability (CVSS 8.5)
- [CVE-2025-47658](https://cve.now/CVE-2025-47658.md): WordPress ELEX HelpDesk & Customer Ticketing System plugin \<= 3.2.9 - Arbitrary File Upload vulnerability (CVSS 9.9)
- [CVE-2025-47643](https://cve.now/CVE-2025-47643.md): WordPress ELEX Product Feed for WooCommerce \<= 3.1.2 - SQL Injection Vulnerability (CVSS 7.6)
- [CVE-2025-3280](https://cve.now/CVE-2025-3280.md): ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes \<= 1.4.9 - Authenticated (Subscriber+) SQL Injection (CVSS 6.5)
- [CVE-2025-31406](https://cve.now/CVE-2025-31406.md): WordPress ELEX WooCommerce Request a Quote plugin \<= 2.3.9 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2024-12171](https://cve.now/CVE-2024-12171.md): ELEX WordPress HelpDesk & Customer Ticketing System \<= 3.2.6 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation (CVSS 8.8)
- [CVE-2025-22352](https://cve.now/CVE-2025-22352.md): WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes Plugin \<= 1.4.9 - SQL Injection vulnerability (CVSS 7.6)
- [CVE-2024-12266](https://cve.now/CVE-2024-12266.md): ELEX WooCommerce Dynamic Pricing and Discounts \<= 2.1.7 - Missing Authorization (CVSS 6.5)
- [CVE-2024-31364](https://cve.now/CVE-2024-31364.md): WordPress ELEX WooCommerce Dynamic Pricing and Discounts plugin \<= 2.1.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2024-32105](https://cve.now/CVE-2024-32105.md): WordPress ELEX WooCommerce Dynamic Pricing and Discounts plugin \<= 2.1.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2024-31255](https://cve.now/CVE-2024-31255.md): WordPress ELEX WooCommerce Dynamic Pricing and Discounts plugin \<= 2.1.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/elextensions
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.