CVE•Published 2026-03-04•1 article on news•6 live references•NVD data

CVE-2023-7337

Vulnerability data via CVEDB (Shodan)

CVSS v3.1

7.5

HIGH

EPSS percentile

Exploit Prediction Scoring System · top 33% of all CVEs

Description

The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to SQL Injection via the 'js-support-ticket-token-tkstatus' cookie in version 2.8.2 due to an incomplete fix for CVE-2023-50839 where a second sink was left with insufficient escaping on the user supplied values and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Timeline

Published 2026-03-04

External references

NVD MITRE Exploit-DB GitHub PoC Sploitus VulnCheck

Search for exposed instances

Shodan + Censys queries derived from NVD's CPE data. The vuln tag catches assets Shodan has explicitly linked to this CVE; the product / banner fingerprints find exposed instances even when the vuln tag was never applied (which is common).

Shodan · vuln tag0 hosts

vuln:CVE-2023-7337

Hosts Shodan has explicitly fingerprinted as vulnerable.

More intel sources (5)

Shodan report

vuln:CVE-2023-7337

Country / ASN / product breakdown for the vuln query.

Censys

vulnerabilities.cve_id: CVE-2023-7337

Censys host search filtered to this CVE id.

grep.app

CVE-2023-7337