Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: SupportCandy – Helpdesk & Support Ticket System 2.2.7 Clear all filters
TI-2021-07162 CVE-2021-24880 · GHSA-g3q8-mx59-88v9

SupportCandy < 2.2.7 - Contributor+ Stored Cross-Site Scripting

Priority LOW 25

The SupportCandy WordPress plugin before 2.2.7 does not validate and escape the page attribute of its shortcode, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00604 Published 2022-02-07 Fixed in 2.2.7 CWE-79
TI-2021-07161 CVE-2021-24879 · GHSA-3wmq-h2jq-wfgw

SupportCandy < 2.2.7 - CSRF to Cross-Site Scripting

Priority LOW 39

The SupportCandy WordPress plugin before 2.2.7 does not have CSRF check in the wpsc_tickets AJAX action, nor has any sanitisation or escaping in some of the filter fields which could allow attackers to make a logged in u…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00612 Published 2022-02-07 Fixed in 2.2.7 CWE-352
TI-2021-07160 CVE-2021-24878 · GHSA-w9r7-4qpm-xxc5

SupportCandy < 2.2.7 - Reflected Cross-Site Scripting

Priority LOW 30

The SupportCandy WordPress plugin before 2.2.7 does not sanitise and escape the query string before outputting it back in pages with the [wpsc_create_ticket] shortcode embed, leading to a Reflected Cross-Site Scripting i…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01345 Published 2022-02-07 Fixed in 2.2.7 CWE-79
TI-2021-07125 CVE-2021-24843 · GHSA-mp5c-f63g-9v5h

SupportCandy < 2.2.7 - Arbitrary Ticket Deletion via CSRF

Priority LOW 29

The SupportCandy WordPress plugin before 2.2.7 does not have CRSF check in its wpsc_tickets AJAX action, which could allow attackers to make a logged in admin call it and delete arbitrary tickets via the set_delete_perma…

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00531 Published 2022-02-07 Fixed in 2.2.7 CWE-352