# cve.now: Joomsky

The newest entries naming Joomsky as an affected vendor (up to 200), of 25 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-57652](https://cve.now/CVE-2026-57652.md): WordPress JS Help Desk plugin \<= 3.1.0 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.3)
- [CVE-2019-25740](https://cve.now/CVE-2019-25740.md): Joomla com\_jsjobs 1.2.6 Arbitrary File Deletion (CVSS 7.1)
- [CVE-2018-25327](https://cve.now/CVE-2018-25327.md): Joomla! Component Js Jobs 1.2.0 Cross-Site Request Forgery (CVSS 6.9)
- [CVE-2020-37226](https://cve.now/CVE-2020-37226.md): Joomla J2 JOBS 1.3.0 Authenticated SQL Injection via sortby (CVSS 7.1)
- [CVE-2020-37224](https://cve.now/CVE-2020-37224.md): Joomla J2 JOBS 1.3.0 Authenticated SQL Injection via sortby (CVSS 7.1)
- [CVE-2026-32535](https://cve.now/CVE-2026-32535.md): WordPress JS Help Desk plugin \<= 3.0.3 - Insecure Direct Object References (IDOR) vulnerability (CVSS 6.5)
- [CVE-2026-32534](https://cve.now/CVE-2026-32534.md): WordPress JS Help Desk plugin \<= 3.0.3 - SQL Injection vulnerability (CVSS 8.5)
- [CVE-2026-24959](https://cve.now/CVE-2026-24959.md): WordPress JS Help Desk plugin \<= 3.0.1 - SQL Injection vulnerability (CVSS 8.5)
- [CVE-2025-58234](https://cve.now/CVE-2025-58234.md): WordPress JS Job Manager Plugin \<= 2.0.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
- [CVE-2025-32626](https://cve.now/CVE-2025-32626.md): WordPress JS Job Manager plugin \<= 2.0.2 - SQL Injection vulnerability (CVSS 9.3)
- [CVE-2025-32660](https://cve.now/CVE-2025-32660.md): WordPress JS Job Manager plugin \<= 2.0.2 - Arbitrary File Upload vulnerability (CVSS 10.0)
- [CVE-2025-32627](https://cve.now/CVE-2025-32627.md): WordPress JS Job Manager plugin \<= 2.0.2 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2025-32146](https://cve.now/CVE-2025-32146.md): WordPress JS Job Manager plugin \<= 2.0.2 - Local File Inclusion vulnerability (CVSS 8.8)
- [CVE-2025-31868](https://cve.now/CVE-2025-31868.md): WordPress JS Job Manager plugin \<= 2.0.2 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2025-31867](https://cve.now/CVE-2025-31867.md): WordPress JS Job Manager Plugin \<= 2.0.2 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.4)
- [CVE-2025-30901](https://cve.now/CVE-2025-30901.md): WordPress JS Help Desk plugin \<= 2.9.2 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2025-30886](https://cve.now/CVE-2025-30886.md): WordPress JS Help Desk plugin \<= 2.9.2 - SQL Injection vulnerability (CVSS 9.3)
- [CVE-2025-30882](https://cve.now/CVE-2025-30882.md): WordPress JS Help Desk plugin \<= 2.9.1 - Arbitrary File Download vulnerability (CVSS 7.5)
- [CVE-2025-30880](https://cve.now/CVE-2025-30880.md): WordPress JS Help Desk plugin \<= 2.9.2 - Broken Access Control vulnerability (CVSS 7.5)
- [CVE-2025-30878](https://cve.now/CVE-2025-30878.md): WordPress JS Help Desk plugin \<= 2.9.2 - Arbitrary File Deletion vulnerability (CVSS 8.6)
- [CVE-2025-25109](https://cve.now/CVE-2025-25109.md): WordPress Vehicle Manager plugin \<= 3.1 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2023-28689](https://cve.now/CVE-2023-28689.md): WordPress JS Job Manager plugin \<= 2.0.0 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2024-51670](https://cve.now/CVE-2024-51670.md): WordPress JS Help Desk plugin \<= 2.8.7 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2023-31087](https://cve.now/CVE-2023-31087.md): WordPress JS Job Manager Plugin \<=2.0.0 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4)
- [CVE-2023-25963](https://cve.now/CVE-2023-25963.md): WordPress JS Job Manager Plugin \<= 2.0.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/joomsky
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.