SupportCandy
PSM Plugins
Developer
3.5.4
Latest version
10,000
Installations
No date
Last updated
Vulnerability history
0 present
23 patched
10 Mitigation rules
- Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability<= 3.5.303/10/2026
- Authenticated (Custom+) SQL Injection vulnerability<= 3.5.302/10/2026
- Unauthenticated Ticket Attachment Disclosure vulnerability3.2.9-3.5.210/09/2026
- Unauthenticated Ticket Content Disclosure vulnerability3.3.6-3.5.209/09/2026
- Broken Authentication vulnerability<= 3.5.118/08/2026
- Cross Site Scripting (XSS) vulnerability<= 3.4.810/07/2026
- Insecure Direct Object References (IDOR) vulnerability<= 3.4.617/06/2026
- WordPress SupportCandy - Helpdesk & Customer Support Ticket System plugin <= 3.4.4 - Authenticated (Subscriber+) SQL Injection via Number Field Filter vulnerability<= 3.4.402/02/2026
- WordPress SupportCandy - Helpdesk & Customer Support Ticket System plugin <= 3.4.4 - Authenticated (Subscriber+) Insecure Direct Object Reference vulnerability<= 3.4.430/01/2026
- Broken Access Control vulnerability<= 3.4.429/01/2026
- Cross Site Request Forgery (CSRF) vulnerability<= 3.4.121/11/2025
- Authentication Bypass to Support Session Takeover vulnerability<= 3.3.720/09/2025
- Insecure Direct Object Reference vulnerability<= 3.3.006/03/2025
- Cross Site Scripting (XSS) vulnerability<= 3.2.315/03/2024
- Subscriber+ SQLi vulnerability< 3.1.719/06/2023
- Admin+ SQLi vulnerability< 3.1.719/06/2023
- Unauthenticated SQLi vulnerability< 3.1.513/04/2023
- Stored Cross-Site Scripting (XSS) vulnerability<= 2.2.605/01/2022
- Cross-Site Request Forgery (CSRF) vulnerability leading to Cross-Site Scripting (XSS)<= 2.2.605/01/2022
- Reflected Cross-Site Scripting (XSS) vulnerability<= 2.2.605/01/2022
- Arbitrary Ticket Deletion via Cross-Site Request Forgery (CSRF) vulnerability<= 2.2.605/01/2022
- Unauthenticated Arbitrary Ticket Deletion vulnerability<= 2.2.405/01/2022
- Arbitrary File Upload vulnerability<= 2.0.017/04/2019