Vanquish Woocommerce Support Ticket System vulnerabilities
5 known vulnerabilities affecting vanquish/woocommerce_support_ticket_system.
Total CVEs
5
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
CRITICAL2HIGH2MEDIUM1
Vulnerabilities
Page 1 of 1
CVE-2024-10627P2CRITICALCVSS 9.8fixed in 17.8≤ 17.72024-11-09
CVE-2024-10627 [CRITICAL] CWE-434 CVE-2024-10627: The WooCommerce Support Ticket System plugin for WordPress is vulnerable to arbitrary file uploads d
The WooCommerce Support Ticket System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajax_manage_file_chunk_upload() function in all versions up to, and including, 17.7. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may mak
nvd
CVE-2024-10625P2CRITICALCVSS 9.1fixed in 17.8≤ 17.62024-11-09
CVE-2024-10625 [CRITICAL] CWE-22 CVE-2024-10625: The WooCommerce Support Ticket System plugin for WordPress is vulnerable to arbitrary file deletion
The WooCommerce Support Ticket System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_tmp_uploaded_file() function in all versions up to, and including, 17.7. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remo
nvd
CVE-2024-10626P3HIGHCVSS 8.1fixed in 17.8≤ 17.72024-11-09
CVE-2024-10626 [HIGH] CWE-22 CVE-2024-10626: The WooCommerce Support Ticket System plugin for WordPress is vulnerable to arbitrary file deletion
The WooCommerce Support Ticket System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_uploaded_file() function in all versions up to, and including, 17.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server
nvd
CVE-2026-32522P3HIGHCVSS 8.6≥ n/a, ≤ < 18.52026-03-25
CVE-2026-32522 [HIGH] CWE-22 CVE-2026-32522: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in vanq
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in vanquish WooCommerce Support Ticket System woocommerce-support-ticket-system allows Path Traversal.This issue affects WooCommerce Support Ticket System: from n/a through < 18.5.
nvd
CVE-2024-13775P4MEDIUMCVSS 5.4fixed in 17.9≤ 17.82025-02-01
CVE-2024-13775 [MEDIUM] CWE-862 CVE-2024-13775: The WooCommerce Support Ticket System plugin for WordPress is vulnerable to unauthorized access and
The WooCommerce Support Ticket System plugin for WordPress is vulnerable to unauthorized access and loss of data due to missing capability checks on the 'ajax_delete_message', 'ajax_get_customers_partial_list', and 'ajax_get_admins_list' functions in all versions up to, and including, 17.8. This makes it possible for authenticated attackers, with Sub
nvd