CVE-2026-57711

MediumCVSS 6.5

Published: 13/07/2026(UTC)Updated: 13/07/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

13th percentile - higher than 13% of all known CVEs

Summary

The SupportCandy plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in versions up to and including 3.4.8. The issue is due to improper input neutralization during web page generation.

Risk Assessment

An attacker can inject malicious JavaScript code that executes in other users' browsers, potentially leading to session theft, account takeover, or data leakage.

Recommendation

Immediately update the SupportCandy plugin to the latest available version that fixes this vulnerability. If no update is available, consider temporarily disabling the plugin.

Other vulnerabilities in SupportCandy

See all

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PSM Plugins SupportCandy supportcandy allows Stored XSS.This issue affects SupportCandy: from n/a through <= 3.4.8.