FuseDesk
FuseDesk has 3 disclosed vulnerabilities in the WordSec catalog, reported between 2025 and 2026; all 3 are fixed as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10. 2025 was the busiest year with 2 disclosures.
The most common weakness is Cross-Site Scripting, behind 3 of the records (100%).
Every one of the 3 issues recorded for FuseDesk has a vendor fix available, so running the current release closes all known holes.
3 independent researchers contributed these findings, one record each. FuseDesk is installed on roughly 40 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.
CVE-2026-1914FuseDesk <= 6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'emailtext' Shortcode Attribute
Read the full analysisVulnerability Records
FuseDesk
Author
Jeremy B. Shapiro
Integrate with FuseDesk so your CRM (Keap, Infusionsoft, ActiveCampaign, Ontraport, GoHighLevel, etc) contacts, membership site members, students, or site visitors can easily open new support cases directly in your FuseDesk help desk application and view their cases. Your website visitors can even start a Live Chat with your support team right from your site! Works great with Membership sites like Memberium, AccessAlly, iMember360, WishList Member, WisP, and more!
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C