CVE-2026-94378
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
The SupportCandy plugin for WordPress up to version 3.5.3 is vulnerable to stored XSS via the 'name' parameter. Authenticated attackers with subscriber-level access can inject scripts that execute when a user visits the page.
Risk Assessment
Risk of session hijacking, data theft, or malware propagation within the website.
Recommendation
Update the SupportCandy plugin to the latest patched version. Restrict user privileges and regularly review content submitted by subscribers.
Other vulnerabilities in SupportCandy
See all- CVE-2026-94539Medium
The SupportCandy plugin for WordPress up to version 3.5.3 is vulnerable to time-based SQL injection via the 'sort_by' parameter. Authenticated attackers with appropriate permissions can modify SQL queries and extract sensitive data from the database.
- CVE-2026-81022Medium
The SupportCandy WordPress plugin before version 3.5.3 does not validate a submitted per-ticket authorization code before disclosing the real code to the requester, allowing unauthenticated users to read the contents of any support ticket.
- CVE-2026-81021Medium
The SupportCandy WordPress plugin before version 3.5.3 does not perform an authorization check on one of its support-ticket attachment download paths, allowing unauthenticated attackers to read protected customer-uploaded attachments by enumerating sequential attachment identifiers.
- CVE-2026-73350High
Unauthenticated Broken Authentication in SupportCandy versions up to 3.5.1.
- CVE-2026-57711Medium
The SupportCandy plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in versions up to and including 3.4.8. The issue is due to improper input neutralization during web page generation.
- CVE-2026-54826High
The SupportCandy plugin version 3.4.6 and earlier contains an Insecure Direct Object References (IDOR) vulnerability for subscribers. This allows unauthorized access to other users' data.
Original NVD description (English source)
The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 3.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This exploit chain requires the 'Register user if not exists' setting to be disabled, which is its default configuration.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS