Freshdesk (official)

Freshdesk (official) has 3 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2024; all 3 are fixed as of September 2026. Their average CVSS score is 6.8, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 1 high.

The most common weakness is Open Redirect, behind 2 of the records (67%). Other recurring categories include Cross-Site Request Forgery (CSRF).

Every one of the 3 issues recorded for Freshdesk (official) has a vendor fix available, so running the current release closes all known holes.

All of these findings were reported by Le Ngoc Anh. Freshdesk (official) is installed on roughly 800 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.4.10.

Strategic Overview

Avg CVSSMedium
6.8/ 10
Patch Coverage100%
Open

0

Fixed

3

Get automatic notifications for all Freshdesk (official) vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.8

Freshdesk (official) <= 2.3.6 - Cross-Site Request Forgery

Read the full analysis

Vulnerability Records

3 records
Plugin Profile
Latestv2.4.1

Freshdesk (official)

Freshworks

Author

Freshworks

2.5(8)
50/100
Last Updated
2024-07-01 (2y ago)
Active Installs
800+
Downloads
47,983
Requires WP
3.4+
Requires PHP
0+
Tested up to
WP 6.4.10
Created
2014-03-07 (13y ago)

With the Freshdesk (official) plugin, you can now: quickly integrate the help widget into your WordPress site or blog convert comments on your WordPress site into Freshdesk tickets allow users on WordPress to seamlessly login to your support portal via SSO Manual Installation Download the latest version of the &#8216;Freshdesk (official)’ plugin from the WordPress plugin directory. Extract the zip and upload the “freshdesk-support” directory to your /wp-content/plugins directory. Go to the &#8216;Plugins’ page in your admin section and activate the plugin. You now have a new admin menu &#8216;Freshdesk’ in your WordPress admin menu bar. Click on it and configure the settings. In case of NGNIX Server Follow the below steps: Case #1 – If your domain is like example.com, add the below line in your nginx.conf (located at /etc/nginx/sites-available/) location / { try_files $uri $uri/ /index.php?q=uri&args; } Case #2 – If your domain is like example.com/freshdesk, add the below line in your nginx.conf (located at /etc/nginx/sites-available/) location /freshdesk { try_files $uri $uri/ /freshdesksso/index.php?q=$uri&$args; } In case of Apache Server Please make sure the “Permalink” set to ” Post name” under “Settings -> Permalink -> Common Settings”

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C