Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · supportcandy
SupportCandy
23 known vulnerabilities on record. Add your version above to see which ones affect you.
Oct 2, 2026SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent: Time-based SQL InjectionCVE-2026-94539 · affects up to 3.5.3 · reported by WordfenceMedium 6.5
The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress is vulnerable to time-based SQL Injection via the 'sort_by' parameter in all versions up to, and including, 3.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires the authenticated attacker to hold both a Subscriber-level (or higher) WordPress role and a SupportCandy Agent account with the 'Assign Agents' permission configured.
NVD recordplugins.svn.wordpress.orgplugins.trac.wordpress.org
Oct 2, 2026SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent: Stored Cross-Site ScriptingCVE-2026-94378 · affects up to 3.5.3 · reported by WordfenceMedium 6.4
The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 3.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This exploit chain requires the 'Register user if not exists' setting to be disabled, which is its default configuration.
NVD recordplugins.svn.wordpress.orgplugins.trac.wordpress.org
Sep 9, 2026SupportCandy: Does not validate a submitted per-ticket authorization code before disclosing the real code to the requesterCVE-2026-81022 · fixed in 3.5.3 · reported by WPScanMedium 5.3
The SupportCandy WordPress plugin before 3.5.3 does not validate a submitted per-ticket authorization code before disclosing the real code to the requester, allowing unauthenticated users to read the contents of any support ticket.
Sep 9, 2026SupportCandy: Does not perform an authorization check on one of its support-ticket attachment download pathsCVE-2026-81021 · fixed in 3.5.3 · reported by WPScanMedium 5.3
The SupportCandy WordPress plugin before 3.5.3 does not perform an authorization check on one of its support-ticket attachment download paths, allowing unauthenticated attackers to read protected customer-uploaded attachments by enumerating sequential attachment identifiers.
Aug 18, 2026Unauthenticated Broken Authentication in SupportCandy <= 3.5.1 versions.CVE-2026-73350 · affects up to 3.5.1 · reported by PatchstackHigh 8.2
Unauthenticated Broken Authentication in SupportCandy <= 3.5.1 versions.
Jul 13, 2026SupportCandy: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57711 · affects up to 3.4.8 · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PSM Plugins SupportCandy supportcandy allows Stored XSS.This issue affects SupportCandy: from n/a through <= 3.4.8.
Jun 26, 2026Subscriber Insecure Direct Object References (IDOR) in SupportCandy <= 3.4.6 versions.CVE-2026-54826 · reported by PatchstackHigh 7.6
Subscriber Insecure Direct Object References (IDOR) in SupportCandy <= 3.4.6 versions.
Feb 19, 2026SupportCandy: Missing AuthorizationCVE-2026-25321 · affects up to 3.4.4 · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in PSM Plugins SupportCandy supportcandy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SupportCandy: from n/a through <= 3.4.4.
Jan 31, 2026SupportCandy – Helpdesk & Customer Support Ticket System: Insecure Direct Object ReferenceCVE-2026-1251 · affects up to 3.4.4 · reported by WordfenceMedium 5.4
The SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.4.4 via the 'add_reply' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to steal file attachments uploaded by other users by specifying arbitrary attachment IDs in the 'description_attachments' parameter, re-associating those files to their own tickets and removing access from the original owners.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 31, 2026SupportCandy – Helpdesk & Customer Support Ticket System: SQL InjectionCVE-2026-0683 · affects up to 3.4.4 · reported by WordfenceMedium 6.5
The SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to SQL Injection via the Number-type custom field filter in all versions up to, and including, 3.4.4. This is due to insufficient escaping on the user-supplied operand value when using the equals operator and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above (customers), to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 9, 2025SupportCandy: Cross-Site Request Forgery (CSRF)CVE-2025-67598 · affects up to 3.4.1 · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in PSM Plugins SupportCandy supportcandy allows Cross Site Request Forgery.This issue affects SupportCandy: from n/a through <= 3.4.1.
Sep 20, 2025SupportCandy – Helpdesk & Customer Support Ticket System: Authentication BypassCVE-2025-10658 · affects up to 3.3.7 · reported by WordfenceMedium 6.5
The SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.3.7. This is due to missing rate limiting on the OTP verification for guest login. This makes it possible for unauthenticated attackers to bypass authentication and gain unauthorized access to customer support tickets by brute forcing the 6-digit OTP code.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 7, 2025SupportCandy – Helpdesk & Customer Support Ticket System: Insecure Direct Object ReferenceCVE-2024-13552 · affects up to 3.3.0 · reported by WordfenceMedium 4.3
The SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.3.0 via file upload due to missing validation on a user controlled key. This makes it possible for authenticated attackers to download attachments for support tickets that don't belong to them. If an admin enables tickets for guests, this can be exploited by unauthenticated attackers.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 10, 2024SupportCandy: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-27991 · affects up to 3.2.3 · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SupportCandy allows Stored XSS.This issue affects SupportCandy: from n/a through 3.2.3.
Jun 19, 2023SupportCandy: Does not properly sanitise and escape the agents[] parameter in the set_add_agent_leaves AJAX function before using it in a SQL statementCVE-2023-2805 · fixed in 3.1.7 · reported by WPScanHigh 7.2
The SupportCandy WordPress plugin before 3.1.7 does not properly sanitise and escape the agents[] parameter in the set_add_agent_leaves AJAX function before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
Jun 19, 2023SupportCandy: Does not properly sanitise and escape the `id` parameter for an Agent in the REST API before using it in an SQL statementCVE-2023-2719 · fixed in 3.1.7 · reported by WPScanHigh 8.8
The SupportCandy WordPress plugin before 3.1.7 does not properly sanitise and escape the `id` parameter for an Agent in the REST API before using it in an SQL statement, leading to an SQL Injection exploitable by users with a role as low as Subscriber.
May 2, 2023SupportCandy: Does not validate and escape user input before using it in an SQL statementCVE-2023-1730 · fixed in 3.1.5 · reported by WPScanCritical 9.8
The SupportCandy WordPress plugin before 3.1.5 does not validate and escape user input before using it in an SQL statement, which could allow unauthenticated attackers to perform SQL injection attacks
Feb 7, 2022SupportCandy: Does not validate and escape the page attribute of its shortcodeCVE-2021-24880 · fixed in 2.2.7 · reported by WPScanMedium 5.4
The SupportCandy WordPress plugin before 2.2.7 does not validate and escape the page attribute of its shortcode, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks
Feb 7, 2022SupportCandy: Does not have CSRF check in the wpsc_tickets AJAX actionCVE-2021-24879 · fixed in 2.2.7 · reported by WPScanHigh 8.8
The SupportCandy WordPress plugin before 2.2.7 does not have CSRF check in the wpsc_tickets AJAX action, nor has any sanitisation or escaping in some of the filter fields which could allow attackers to make a logged in user having access to the ticket lists dashboard set an arbitrary filter (stored in their cookies) with an XSS payload in it.
Feb 7, 2022SupportCandy: Does not sanitise and escape the query string before outputting it back in pages with the [wpsc_create_ticket] shortcode embedCVE-2021-24878 · fixed in 2.2.7 · reported by WPScanMedium 6.1
The SupportCandy WordPress plugin before 2.2.7 does not sanitise and escape the query string before outputting it back in pages with the [wpsc_create_ticket] shortcode embed, leading to a Reflected Cross-Site Scripting issue
Feb 7, 2022SupportCandy: Does not have CRSF check in its wpsc_tickets AJAX actionCVE-2021-24843 · fixed in 2.2.7 · reported by WPScanMedium 6.5
The SupportCandy WordPress plugin before 2.2.7 does not have CRSF check in its wpsc_tickets AJAX action, which could allow attackers to make a logged in admin call it and delete arbitrary tickets via the set_delete_permanently_bulk_ticket setting_action.
Feb 7, 2022SupportCandy: Does not have authorisation and CSRF checks in its wpsc_tickets AJAX actionCVE-2021-24839 · fixed in 2.2.5 · reported by WPScanHigh 7.5
The SupportCandy WordPress plugin before 2.2.5 does not have authorisation and CSRF checks in its wpsc_tickets AJAX action, which could allow unauthenticated users to call it and delete arbitrary tickets via the set_delete_permanently_bulk_ticket setting_action. Other actions may be affected as well.
Apr 18, 2019An Unrestricted File Upload Vulnerability in the SupportCandy plugin through 2.0.0 for WordPress allows remote attackers to execute arbitrary code by uploading CVE-2019-11223 · affects up to 2.0.0 · reported by MITRECritical 9.8
An Unrestricted File Upload Vulnerability in the SupportCandy plugin through 2.0.0 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.