TI-2026-51470 CVE-2026-73350 · GHSA-fm54-qhj9-vvcr
WordPress SupportCandy plugin <= 3.5.1 - Broken Authentication vulnerability
Priority MEDIUM 42
Unauthenticated Broken Authentication in SupportCandy <= 3.5.1 versions.
psmplugins
Records11All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9
Exploited now
psmplugins records in CISA KEVNo psmplugins vulnerabilities are listed in CISA KEV.
Records
11 records
TI-2025-09757 CVE-2025-10658 · GHSA-532f-pqv9-9f5r
SupportCandy – Helpdesk & Customer Support Ticket System <= 3.3.7 - Authentication Bypass to Support Session Takeover
Priority LOW 35
The SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.3.7.
TI-2026-39629 CVE-2026-54826 · GHSA-6mpj-cp6h-6c54
WordPress SupportCandy plugin <= 3.4.6 - Insecure Direct Object References (IDOR) vulnerability
Priority LOW 33
Subscriber Insecure Direct Object References (IDOR) in SupportCandy <= 3.4.6 versions.
TI-2026-20439 CVE-2026-25321 · GHSA-fv8p-2x46-62xh
WordPress SupportCandy plugin <= 3.4.4 - Broken Access Control vulnerability
Priority LOW 30
Missing Authorization vulnerability in PSM Plugins SupportCandy supportcandy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SupportCandy: from n/a through <= 3.4.4.
TI-2026-00475 CVE-2026-0683 · GHSA-mmpc-h738-6mc3
SQL injection in psmplugins SupportCandy – Helpdesk & Customer Support Ticket System
Priority LOW 29
The SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to SQL Injection via the Number-type custom field filter in all versions up to, and including, 3.4.4.
TI-2026-67401 CVE-2026-94539 · GHSA-xqwv-9f36-ccgr
SupportCandy <= 3.5.3 - Authenticated (Custom+) SQL Injection via 'sort_by' Parameter
Priority LOW 28
The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress is vulnerable to time-based SQL Injection via the 'sort_by' parameter in all versions up to, and including, 3.5.3 due to insu…
TI-2026-67400 CVE-2026-94378 · GHSA-8cxj-g538-75wh
SupportCandy <= 3.5.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'name' Parameter
Priority LOW 28
The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 3.5.3 due to insu…
TI-2026-41535 CVE-2026-57711 · GHSA-3hhp-286q-9r4c
WordPress SupportCandy plugin <= 3.4.8 - Cross Site Scripting (XSS) vulnerability
Priority LOW 28
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PSM Plugins SupportCandy supportcandy allows Stored XSS.This issue affects SupportCandy: from n/a through <= 3.4.8.
TI-2026-00970 CVE-2026-1251 · GHSA-h992-gjw5-53j3
Authorization bypass in psmplugins SupportCandy – Helpdesk & Customer Support Ticket…
Priority LOW 24
The SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.4.4 via the 'add_reply' function due to missing…
TI-2024-12593 CVE-2024-13552 · GHSA-94m4-pqm7-568j
SupportCandy – Helpdesk & Customer Support Ticket System <= 3.3.0 - Insecure Direct Object Reference
Priority LOW 20
The SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.3.0 via file upload due to missing validation on…
TI-2025-41352 CVE-2025-67598 · GHSA-69r3-vvfx-9ff9
WordPress SupportCandy plugin <= 3.4.1 - Cross Site Request Forgery (CSRF) vulnerability
Priority LOW 19
Cross-Site Request Forgery (CSRF) vulnerability in PSM Plugins SupportCandy supportcandy allows Cross Site Request Forgery.This issue affects SupportCandy: from n/a through <= 3.4.1.