6.5
Medium
CVE-2026-14931 The JS Help Desk WordPress plugin before 3.1.4 grants a support-agent capability to the Contributor role on…
Description
The JS Help Desk WordPress plugin before 3.1.4 grants a support-agent capability to the Contributor role on activation and does not perform a capability check on a user-listing handler, allowing Contributor-level users to enumerate the email addresses of all registered WordPress users.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| JS Help Desk 3.1 | earliest → < 3.1.4 | 3.1.4 |
Other CVEs of JS Help Desk
The 5 CVEs of JS Help Desk →
CVE-2026-15209
The JS Help Desk WordPress plugin before 3.1.5 does not verify that the requesting user owns the ticket being loaded: a…
6.5
Medium
CVE-2026-14929
The JS Help Desk WordPress plugin before 3.1.4 does not verify ownership of the targeted reply before updating it,…
4.3
Medium
CVE-2026-14930
The JS Help Desk WordPress plugin before 3.1.4 does not perform any authorization, nonce, or ownership check on a…
7.5
High
CVE-2026-14928
The JS Help Desk WordPress plugin before 3.1.4 does not perform authorization or ownership checks before returning…
6.5
Medium