SupportCandy vulnerabilities

The SupportCandy plugin for WordPress up to version 3.5.3 is vulnerable to time-based SQL injection via the 'sort_by' parameter. Authenticated attackers with appropriate permissions can modify SQL queries and extract sensitive data from the database.

The SupportCandy plugin for WordPress up to version 3.5.3 is vulnerable to stored XSS via the 'name' parameter. Authenticated attackers with subscriber-level access can inject scripts that execute when a user visits the page.

The SupportCandy WordPress plugin before version 3.5.3 does not validate a submitted per-ticket authorization code before disclosing the real code to the requester, allowing unauthenticated users to read the contents of any support ticket.

The SupportCandy WordPress plugin before version 3.5.3 does not perform an authorization check on one of its support-ticket attachment download paths, allowing unauthenticated attackers to read protected customer-uploaded attachments by enumerating sequential attachment identifiers.

Unauthenticated Broken Authentication in SupportCandy versions up to 3.5.1.

The SupportCandy plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in versions up to and including 3.4.8. The issue is due to improper input neutralization during web page generation.

The SupportCandy plugin version 3.4.6 and earlier contains an Insecure Direct Object References (IDOR) vulnerability for subscribers. This allows unauthorized access to other users' data.