Plugin icon

SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent

supportcandy

Vulnerabilities:

23

Last Updated:

September 29, 2026

Active Installs:

10000

Published
Title
Fixed in
CVSS
Published
2026-10-02
Title
SupportCandy < 3.5.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'name' Parameter
Fixed in
Fixed in 3.5.4
CVSS
6.4 (medium)
Published
2026-10-02
Title
SupportCandy < 3.5.4 - Authenticated (Custom+) SQL Injection via 'sort_by' Parameter
Fixed in
Fixed in 3.5.4
CVSS
6.5 (medium)
Published
2026-09-07
Title
SupportCandy 3.3.6 - 3.5.2 - Unauthenticated Ticket Content Disclosure via Auth Code Leak
Fixed in
Fixed in 3.5.3
CVSS
5.3 (medium)
Published
2026-09-07
Title
SupportCandy 3.2.9 - 3.5.2 - Unauthenticated Ticket Attachment Disclosure
Fixed in
Fixed in 3.5.3
CVSS
5.3 (medium)
Published
2026-08-18
Title
SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent < 3.5.2 - Missing Authorization
Fixed in
Fixed in 3.5.2
CVSS
5.3 (medium)
Published
2026-07-10
Title
SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent < 3.4.9 - Authenticated (Customer+) Stored Cross-Site Scripting
Fixed in
Fixed in 3.4.9
CVSS
6.4 (medium)
Published
2026-06-17
Title
SupportCandy – Helpdesk & Customer Support Ticket System < 3.4.7 - Authenticated (Subscriber+) Insecure Direct Object Reference
Fixed in
Fixed in 3.4.7
CVSS
4.3 (medium)
Published
2026-01-30
Title
SupportCandy – Helpdesk & Customer Support Ticket System < 3.4.5 - Authenticated (Subscriber+) SQL Injection via Number Field Filter
Fixed in
Fixed in 3.4.5
CVSS
6.5 (medium)
Published
2026-01-29
Title
SupportCandy – Helpdesk & Customer Support Ticket System < 3.4.5 - Missing Authorization
Fixed in
Fixed in 3.4.5
CVSS
5.3 (medium)
Published
2026-01-23
Title
SupportCandy – Helpdesk & Customer Support Ticket System < 3.4.5 - Authenticated (Subscriber+) Insecure Direct Object Reference
Fixed in
Fixed in 3.4.5
CVSS
5.4 (medium)
Published
2025-11-21
Title
SupportCandy < 3.4.2 - Cross-Site Request Forgery
Fixed in
Fixed in 3.4.2
CVSS
4.3 (medium)
Published
2025-09-19
Title
SupportCandy < 3.3.8 - Authentication Bypass to Support Session Takeover
Fixed in
Fixed in 3.3.8
CVSS
6.5 (medium)
Published
2025-03-06
Title
SupportCandy < 3.3.1 - Support Ticket Attachments Download via IDOR
Fixed in
Fixed in 3.3.1
CVSS
4.3 (medium)
Published
2024-03-15
Title
SupportCandy < 3.2.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Fixed in
Fixed in 3.2.4
CVSS
6.4 (medium)
Published
2023-05-22
Title
SupportCandy < 3.1.7 - Subscriber+ SQLi
Fixed in
Fixed in 3.1.7
CVSS
7.7 (high)
Published
2023-05-22
Title
SupportCandy < 3.1.7 - Admin+ SQLi
Fixed in
Fixed in 3.1.7
CVSS
4.1 (medium)
Published
2023-04-10
Title
SupportCandy < 3.1.5 - Unauthenticated SQLi
Fixed in
Fixed in 3.1.5
CVSS
8.6 (high)
Published
2022-01-05
Title
SupportCandy < 2.2.7 - Arbitrary Ticket Deletion via CSRF
Fixed in
Fixed in 2.2.7
CVSS
7.1 (high)
Published
2022-01-05
Title
SupportCandy < 2.2.7 - Contributor+ Stored Cross-Site Scripting
Fixed in
Fixed in 2.2.7
CVSS
6.8 (medium)
Published
2022-01-05
Title
SupportCandy < 2.2.7 - Reflected Cross-Site Scripting
Fixed in
Fixed in 2.2.7
CVSS
6.1 (medium)
Published
2022-01-05
Title
SupportCandy < 2.2.5 - Unauthenticated Arbitrary Ticket Deletion
Fixed in
Fixed in 2.2.5
CVSS
8.2 (high)
Published
2022-01-05
Title
SupportCandy < 2.2.7 - CSRF to Cross-Site Scripting
Fixed in
Fixed in 2.2.7
CVSS
4.7 (medium)
Published
2019-04-17
Title
SupportCandy <= 2.0.0 - Arbitrary File Upload
Fixed in
Fixed in 2.0.1
CVSS
9.8 (critical)