Supportcandy (Unknown) - vulnerabilities (CVEs)

5 CVEs, 0 in the last 30 days, 2 known versions, newest CVE from 2026-09-09. Vendor: Unknown.

CVEs of Supportcandy

• CVE-2026-81021 - CVSS 5.3 (medium), 2026-09-09: The SupportCandy WordPress plugin before 3.5.3 does not perform an authorization check on one of its support-ticket attachment download paths, allowing…
• CVE-2026-81022 - CVSS 5.3 (medium), 2026-09-09: The SupportCandy WordPress plugin before 3.5.3 does not validate a submitted per-ticket authorization code before disclosing the real code to the requester,…
• CVE-2023-2805 - CVSS 7.2 (high), 2023-06-19: The SupportCandy WordPress plugin before 3.1.7 does not properly sanitise and escape the agents[] parameter in the set_add_agent_leaves AJAX function before…
• CVE-2023-2719 - CVSS 8.8 (high), 2023-06-19: The SupportCandy WordPress plugin before 3.1.7 does not properly sanitise and escape the `id` parameter for an Agent in the REST API before using it in an SQL…
• CVE-2023-1730 - CVSS 9.8 (critical), 2023-05-02: The SupportCandy WordPress plugin before 3.1.5 does not validate and escape user input before using it in an SQL statement, which could allow unauthenticated…