TI-2021-07161 Aliases CVE-2021-24879 GHSA-3wmq-h2jq-wfgw

SupportCandy < 2.2.7 - CSRF to Cross-Site Scripting

LOW 39CWE-352Published 2022-02-07 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Tampering
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-352.

Summary

The SupportCandy WordPress plugin before 2.2.7 does not have CSRF check in the wpsc_tickets AJAX action, nor has any sanitisation or escaping in some of the filter fields which could allow attackers to make a logged in user having access to the ticket lists dashboard set an arbitrary filter (stored in their cookies) with an XSS payload in it.

Why it matters now

EPSS 0.00612 49th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed SupportCandy – Helpdesk & Support Ticket System (Unknown): 2.2.7

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Unknown	SupportCandy – Helpdesk & Support Ticket System	2.2.7 to before 2.2.7	2.2.7	Patch available	CNA

SupportCandy – Helpdesk & Support Ticket System VendorUnknown Affected 2.2.7 to before 2.2.7 Fixed in 2.2.7 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:supportcandy:supportcandy::::::wordpress::*	before 2.2.7	Vulnerable	SupportCandy

cpe:2.3:a:supportcandy:supportcandy:*:*:*:*:*:wordpress:*:* Versions before 2.2.7 Vulnerable ·SupportCandy

Remediation

Fix · CNA SupportCandy – Helpdesk & Support Ticket System (Unknown) Fixed in 2.2.7

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2022-02-07
SupportCandy – Helpdesk & Support Ticket System 2.2.7
4 records Highest priority Priority LOW 4 LOW
Other records, highest priority first
- TI-2021-07160 SupportCandy < 2.2.7 - Reflected Cross-Site ScriptingPriority LOW 30
- TI-2021-07125 SupportCandy < 2.2.7 - Arbitrary Ticket Deletion via CSRFPriority LOW 29
- TI-2021-07162 SupportCandy < 2.2.7 - Contributor+ Stored Cross-Site ScriptingPriority LOW 25
Show all 4 records →

Timeline

2026-10-02 Threatist record created from CVE-2021-24879
2026-10-03 Alias added: GHSA-3wmq-h2jq-wfgw

References

Exploit 1

https://wpscan.com/vulnerability/6dfb4f61-c8cb-40ad-812f-139482be0fb4

TI-2023-01623 SupportCandy < 3.1.5 - Unauthenticated SQLi CVSS 3.1CRITICAL 9.8
TI-2023-02547 SupportCandy < 3.1.7 - Subscriber+ SQLi CVSS 3.1HIGH 8.8
TI-2023-02628 SupportCandy < 3.1.7 - Admin+ SQLi CVSS 3.1HIGH 7.2
TI-2019-08400 An Unrestricted File Upload Vulnerability in the SupportCandy plugin through 2.0.0 for… CVSS 3.0CRITICAL 9.8
TI-2021-07121 SupportCandy < 2.2.5 - Unauthenticated Arbitrary Ticket Deletion CVSS 3.1HIGH 7.5
TI-2021-07160 SupportCandy < 2.2.7 - Reflected Cross-Site Scripting CVSS 3.1MEDIUM 6.1

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences