Elula maintains a narrowly focused endpoint-management product, WSDesk, that despite modest disclosure volume occupies a notable position in the vulnerability landscape as a widely deployed administrative tool. The recurring weakness classes—missing authorization, unrestricted file uploads, authorization bypass through user-controlled keys, and improper privilege management—reflect the access-control and input-handling demands of software that manages endpoint configurations and credentials, where flaws in authentication or validation can directly compromise managed systems. Defenders should prioritize WSDesk deployments for exposure review and treatment of administrative boundaries; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Elula over time
Signals from CVEs in this vendor scope (10 CVEs).
10 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2025-11456CRITICAL The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the eh_crm_new_ticket_po | Nov 21, 2025 | 9.8 | 33 | NO | NO |
CVE-2025-13534HIGH The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.3.2. This is due to missi | Dec 2, 2025 | 8.8 | 27 | NO | NO |
CVE-2024-12171HIGH The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the 'eh_crm_agent_add_user' | Feb 1, 2025 | 8.8 | 25 | NO | NO |
CVE-2025-47658HIGH Unrestricted Upload of File with Dangerous Type vulnerability in ELEXtensions ELEX WordPress HelpDesk & Customer Ticketing System elex-helpdesk-customer-support-ticket-system allow | May 23, 2025 | 8.8 | 24 | NO | NO |
CVE-2025-12169MEDIUM The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_eh | Nov 21, 2025 | 4.3 | 18 | NO | NO |
CVE-2025-12023MEDIUM The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the eh_crm_rest | Nov 21, 2025 | 4.3 | 18 | NO | NO |
CVE-2025-12022MEDIUM The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'eh_crm_set | Nov 21, 2025 | 4.3 | 18 | NO | NO |
CVE-2025-10054MEDIUM The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'eh_crm_rem | Nov 21, 2025 | 4.3 | 17 | NO | NO |
CVE-2025-10039MEDIUM The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.2.9 via the ' | Nov 21, 2025 | 4.3 | 17 | NO | NO |
CVE-2025-12085MEDIUM The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'eh_crm_set | Nov 21, 2025 | 4.3 | 17 | NO | NO |
Signals from CVEs in this vendor scope (10 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Elula.
Media articles that mention a CVE ID that affects a product developed by Elula — matched by CVE ID, not by vendor name.