Guest Support [guest-support] < 1.3.0
unknown
[en] The Guest Support plugin for WordPress is vulnerable to User Email Disclosure in versions up to, and including, 1.2.3. This is due to the plugin exposing a public AJAX endpoint that allows anyone to search for and retrieve user email addresses without any authentication or capability checks. This makes it possible...
- Affected:
- up to 1.3.0
- Fixed in:
- 1.3.0
- Disclosed:
- Dec 12, 2025
CVE-2025-13660 on NVD →
Guest Support <= 1.2.3 - Unauthenticated User Email Disclosure in guest_support_handler AJAX Endpoint
medium
The Guest Support plugin for WordPress is vulnerable to User Email Disclosure in versions up to, and including, 1.2.3. This is due to the plugin exposing a public AJAX endpoint that allows anyone to search for and retrieve user email addresses without any authentication or capability checks. This makes it possible for...
- CVSS:
- 5.3
- Affected:
- up to 1.2.3
- Fixed in:
- 1.3.0
- Disclosed:
- Dec 11, 2025
CVE-2025-13660 on NVD →
Guest Support – Complete customer support ticket system for WordPress <= 1.2.2 - Missing Authorization to Unauthenticated Ticket Deletion
medium
The Guest Support – Complete customer support ticket system for WordPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'deleteMassTickets' function in all versions up to, and including, 1.2.2. This makes it possible for unauthenticated attackers to delete arbi...
- CVSS:
- 5.3
- Affected:
- up to 1.2.2
- Fixed in:
- 1.2.3
- Disclosed:
- Jul 7, 2025
CVE-2025-5957 on NVD →
Guest Support [guest-support] < 1.2.3
unknown
- Affected:
- up to 1.2.3
- Fixed in:
- 1.2.3
CVE-2025-5957 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database