SupportCandy – Helpdesk & Support Ticket System

Information

Software Type	Plugin
Software Slug	supportcandy (view on wordpress.org)
Software Status	Active
Software Author	supportcandy
Software Website	wordpress.org
Software Downloads	294,622
Software Active Installs	10,000
Software Record Last Updated	October 1, 2023

10 vulnerabilities

SupportCandy <= 3.1.6 - Authenticated (Admin+) SQL Injection

7.2

CVE-2023-2805

May 22, 2023

Researcher: dc11

SupportCandy <= 3.1.6 - Authenticated (Subscriber+) SQL Injection

8.8

CVE-2023-2719

May 22, 2023

Researcher: dc11

SupportCandy <= 3.1.4 - Unauthenticated SQL Injection via parse_user_filters

9.8

CVE-2023-1730

Apr 10, 2023

Researcher: dc11

SupportCandy <= 3.1.3 - Sensitive Data Exposure

6.5

CVE ID Unknown

Mar 28, 2023

Researchers:

SupportCandy – Helpdesk & Support Ticket System <= 2.2.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1

CVE-2021-24879

Jan 5, 2022

Researcher: apple502j

SupportCandy <= 2.2.6 - Reflected Cross-Site Scripting

6.1

CVE-2021-24878

Jan 5, 2022

Researcher: apple502j

SupportCandy <= 2.2.4 - Unauthenticated Arbitrary Ticket Deletion

7.5

CVE-2021-24839

Jan 5, 2022

Researcher: Brandon James Roldan

SupportCandy <= 2.2.6 - Cross-Site Request Forgery to Arbitrary Ticket Deletion

6.5

CVE-2021-24843

Jan 4, 2022

Researcher: apple502j

SupportCandy <= 2.2.6 - Stored Cross-Site Scripting via Shortcode

6.4

CVE-2021-24880

Jan 4, 2022

Researcher: apple502j

SupportCandy – Helpdesk & Support Ticket System <= 2.0.0 - Arbitrary File Upload

9.8

CVE-2019-11223

Apr 17, 2019

Researcher: Christian Angel

Title	CVE ID	CVSS	Researchers	Date
SupportCandy <= 3.1.6 - Authenticated (Admin+) SQL Injection	CVE-2023-2805	7.2	dc11	May 22, 2023
SupportCandy <= 3.1.6 - Authenticated (Subscriber+) SQL Injection	CVE-2023-2719	8.8	dc11	May 22, 2023
SupportCandy <= 3.1.4 - Unauthenticated SQL Injection via parse_user_filters	CVE-2023-1730	9.8	dc11	April 10, 2023
SupportCandy <= 3.1.3 - Sensitive Data Exposure		6.5		March 28, 2023
SupportCandy – Helpdesk & Support Ticket System <= 2.2.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting	CVE-2021-24879	6.1	apple502j	January 5, 2022
SupportCandy <= 2.2.6 - Reflected Cross-Site Scripting	CVE-2021-24878	6.1	apple502j	January 5, 2022
SupportCandy <= 2.2.4 - Unauthenticated Arbitrary Ticket Deletion	CVE-2021-24839	7.5	Brandon James Roldan	January 5, 2022
SupportCandy <= 2.2.6 - Cross-Site Request Forgery to Arbitrary Ticket Deletion	CVE-2021-24843	6.5	apple502j	January 4, 2022
SupportCandy <= 2.2.6 - Stored Cross-Site Scripting via Shortcode	CVE-2021-24880	6.4	apple502j	January 4, 2022
SupportCandy – Helpdesk & Support Ticket System <= 2.0.0 - Arbitrary File Upload	CVE-2019-11223	9.8	Christian Angel	April 17, 2019

All the threat data shared in this database is powered by Wordfence Intelligence Enterprise.
Interested in integrating this data into your platform or network?
Contact us now to discuss API access to our Wordfence Intelligence Enterprise Data Feeds.

Inquire Now

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation