Skip to content
OpenAdvisories

Vendor

psmplugins

6 known vulnerabilities.

Products

SupportCandy – Helpdesk & Customer Support Ticket System 4 SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent 2
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 6.4
    CVE-2026-94378

    SupportCandy <= 3.5.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'name' Parameter

    The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 3.5.3 due to insufficient input sanitization and output …

    psmplugins SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent Web / CMS
  • Medium 6.5
    CVE-2026-94539

    SupportCandy <= 3.5.3 - Authenticated (Custom+) SQL Injection via 'sort_by' Parameter

    The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress is vulnerable to time-based SQL Injection via the 'sort_by' parameter in all versions up to, and including, 3.5.3 due to insufficient escaping on the user supplied …

    psmplugins SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent Web / CMS
  • Medium 5.4
    CVE-2026-1251

    SupportCandy – Helpdesk & Customer Support Ticket System <= 3.4.4 - Authenticated (Subscriber+) Insecure Direct Object Reference

    The SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.4.4 via the 'add_reply' function due to missing validation on a user controlled key. Th…

    psmplugins SupportCandy – Helpdesk & Customer Support Ticket System Web / CMS
  • Medium 6.5
    CVE-2026-0683

    SupportCandy – Helpdesk & Customer Support Ticket System <= 3.4.4 - Authenticated (Subscriber+) SQL Injection via Number Field Filter

    The SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to SQL Injection via the Number-type custom field filter in all versions up to, and including, 3.4.4. This is due to insufficient escaping on the user-supplied ope…

    psmplugins SupportCandy – Helpdesk & Customer Support Ticket System Web / CMS
  • Medium 6.5
    CVE-2025-10658 Public exploit

    SupportCandy – Helpdesk & Customer Support Ticket System <= 3.3.7 - Authentication Bypass to Support Session Takeover

    The SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.3.7. This is due to missing rate limiting on the OTP verification for guest login. This makes it p…

    psmplugins SupportCandy – Helpdesk & Customer Support Ticket System Web / CMS
  • Medium 4.3
    CVE-2024-13552

    SupportCandy – Helpdesk & Customer Support Ticket System <= 3.3.0 - Insecure Direct Object Reference

    The SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.3.0 via file upload due to missing validation on a user controlled key. This makes it p…

    psmplugins SupportCandy – Helpdesk & Customer Support Ticket System Web / CMS