Login Request a demo
SU
Product
SupportCandy
by SupportCandy · last CVE Mar 21, 2024
10
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities10In the news0Timeline
Severity mix
Critical 2High 4Medium 4Low 0
Severity
All severities10Critical2High4Medium4Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add SupportCandy to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2024-27991
6.5
0%
Mar 21
WordPress SupportCandy plugin <= 3.2.3 - Cross Site Scripting (XSS) vulnerability
Affected: through 3.2.3
CVE-2021-24843
6.5
1%
Feb 7
The SupportCandy WordPress plugin before 2.2.7 does not have CRSF check in its wpsc_tickets AJAX action, which could allow attackers to make a logged in admin call it and delete…
Affected: before 2.2.7
CVE-2021-24878
6.1
1%
Feb 7
The SupportCandy WordPress plugin before 2.2.7 does not sanitise and escape the query string before outputting it back in pages with the [wpsc_create_ticket] shortcode embed,…
Affected: before 2.2.7
CVE-2021-24880
5.4
1%
Feb 7
The SupportCandy WordPress plugin before 2.2.7 does not validate and escape the page attribute of its shortcode, which could allow users with a role as low as Contributor to…
Affected: before 2.2.7
Showing 4