Vulnerabilities

TI-2026-67401 CVE-2026-94539 · GHSA-xqwv-9f36-ccgr

SupportCandy <= 3.5.3 - Authenticated (Custom+) SQL Injection via 'sort_by' Parameter

LOW 28

The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress is vulnerable to time-based SQL Injection via the 'sort_by' parameter in all versions up to, and including, 3.5.3 due to insu…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00267 Published 2026-10-03 No fix listed CWE-89

TI-2026-67400 CVE-2026-94378 · GHSA-8cxj-g538-75wh

SupportCandy <= 3.5.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'name' Parameter

LOW 28

The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 3.5.3 due to insu…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00195 Published 2026-10-03 No fix listed CWE-79

TI-2026-51470 CVE-2026-73350 · GHSA-fm54-qhj9-vvcr

WordPress SupportCandy plugin <= 3.5.1 - Broken Authentication vulnerability

MEDIUM 42

Unauthenticated Broken Authentication in SupportCandy <= 3.5.1 versions.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00413 Published 2026-08-18 No fix listed CWE-266

TI-2026-41535 CVE-2026-57711 · GHSA-3hhp-286q-9r4c

WordPress SupportCandy plugin <= 3.4.8 - Cross Site Scripting (XSS) vulnerability

LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PSM Plugins SupportCandy supportcandy allows Stored XSS.This issue affects SupportCandy: from n/a through <= 3.4.8.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00224 Published 2026-07-13 No fix listed CWE-79

TI-2026-39629 CVE-2026-54826 · GHSA-6mpj-cp6h-6c54

WordPress SupportCandy plugin <= 3.4.6 - Insecure Direct Object References (IDOR) vulnerability

LOW 33

Subscriber Insecure Direct Object References (IDOR) in SupportCandy <= 3.4.6 versions.

CVSS 3.1HIGH 7.6 Network Low privileges No interaction EPSS 0.0031 Published 2026-06-26 No fix listed CWE-639

TI-2026-20439 CVE-2026-25321 · GHSA-fv8p-2x46-62xh

WordPress SupportCandy plugin <= 3.4.4 - Broken Access Control vulnerability

LOW 30

Missing Authorization vulnerability in PSM Plugins SupportCandy supportcandy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SupportCandy: from n/a through <= 3.4.4.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00249 Published 2026-02-19 No fix listed CWE-862

TI-2026-00970 CVE-2026-1251 · GHSA-h992-gjw5-53j3

Authorization bypass in psmplugins SupportCandy – Helpdesk & Customer Support Ticket…

LOW 24

The SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.4.4 via the 'add_reply' function due to missing…

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00308 Published 2026-01-31 No fix listed CWE-639

TI-2026-00475 CVE-2026-0683 · GHSA-mmpc-h738-6mc3

SQL injection in psmplugins SupportCandy – Helpdesk & Customer Support Ticket System

LOW 29

The SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to SQL Injection via the Number-type custom field filter in all versions up to, and including, 3.4.4.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0038 Published 2026-01-31 No fix listed CWE-89

TI-2025-41352 CVE-2025-67598 · GHSA-69r3-vvfx-9ff9

WordPress SupportCandy plugin <= 3.4.1 - Cross Site Request Forgery (CSRF) vulnerability

LOW 19

Cross-Site Request Forgery (CSRF) vulnerability in PSM Plugins SupportCandy supportcandy allows Cross Site Request Forgery.This issue affects SupportCandy: from n/a through <= 3.4.1.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00119 Published 2025-12-09 No fix listed CWE-352

TI-2025-09757 CVE-2025-10658 · GHSA-532f-pqv9-9f5r

SupportCandy – Helpdesk & Customer Support Ticket System <= 3.3.7 - Authentication Bypass to Support Session Takeover

LOW 35

The SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.3.7.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00341 Published 2025-09-20 No fix listed CWE-307

TI-2024-12593 CVE-2024-13552 · GHSA-94m4-pqm7-568j

SupportCandy – Helpdesk & Customer Support Ticket System <= 3.3.0 - Insecure Direct Object Reference

LOW 20

The SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.3.0 via file upload due to missing validation on…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00328 Published 2025-03-07 No fix listed CWE-285

Vulnerabilities

Filters