WordPress Plugin Vulnerabilities | Page 145 | WPScan

0-9
a
b
c
d
e
f
g
h
i
j
k
l
m
n
o
p
q
r
s
t
u
v
w
x
y
z

Slug

Published

2022-01-05

Title

SupportCandy < 2.2.7 - Arbitrary Ticket Deletion via CSRF

Slug

Published

2022-01-05

Title

SupportCandy < 2.2.5 - Unauthenticated Arbitrary Ticket Deletion

Slug

Published

2023-04-10

Title

SupportCandy < 3.1.5 - Unauthenticated SQLi

Slug

Published

2023-05-22

Title

SupportCandy < 3.1.7 - Subscriber+ SQLi

Slug

Published

2023-05-22

Title

SupportCandy < 3.1.7 - Admin+ SQLi

Slug

Published

2024-03-15

Title

SupportCandy < 3.2.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting

Slug

Published

2025-03-06

Title

SupportCandy < 3.3.1 - Support Ticket Attachments Download via IDOR

Slug

Published

2025-09-19

Title

SupportCandy < 3.3.8 - Authentication Bypass to Support Session Takeover

Slug

Published

2025-11-21

Title

SupportCandy < 3.4.2 - Cross-Site Request Forgery

Slug

Published

2026-01-23

Title

SupportCandy – Helpdesk & Customer Support Ticket System < 3.4.5 - Authenticated (Subscriber+) Insecure Direct Object Reference

Slug

Published

2026-01-30

Title

SupportCandy – Helpdesk & Customer Support Ticket System < 3.4.5 - Authenticated (Subscriber+) SQL Injection via Number Field Filter

Slug

Published

2026-01-29

Title

SupportCandy – Helpdesk & Customer Support Ticket System < 3.4.5 - Missing Authorization

Slug

Published

2026-06-17

Title

SupportCandy – Helpdesk & Customer Support Ticket System < 3.4.7 - Authenticated (Subscriber+) Insecure Direct Object Reference

Slug

Published

2026-07-10

Title

SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent < 3.4.9 - Authenticated (Customer+) Stored Cross-Site Scripting

Slug

Published

2026-08-18

Title

SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent < 3.5.2 - Missing Authorization

Slug

Published

2026-09-07

Title

SupportCandy 3.2.9 - 3.5.2 - Unauthenticated Ticket Attachment Disclosure

Slug

Published

2026-09-07

Title

SupportCandy 3.3.6 - 3.5.2 - Unauthenticated Ticket Content Disclosure via Auth Code Leak

Slug

Published

2026-10-02

Title

SupportCandy < 3.5.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'name' Parameter

Slug

Published

2026-10-02

Title

SupportCandy < 3.5.4 - Authenticated (Custom+) SQL Injection via 'sort_by' Parameter

Slug

Published

2014-11-13

Title

SupportEzzy Ticket System 1.2.5 - Cross Site Scripting

Slug

Published

2016-06-28

Title

SupportFlow <= 0.6 - Stored Cross-Site Scripting (XSS)

Slug

supra-csv-parser

Published

2022-12-05

Title

Supra CSV <= 4.0.3 - Stored Cross-Site Scripting via CSRF

Slug

supreme-addons-for-beaver-builder-lite

Published

2025-07-23

Title

Supreme Addons for Beaver Builder <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via auto_qrcodesabb Shortcode

Slug

supreme-modules-for-divi

Published

2024-05-01

Title

Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder < 2.5.4 - Contrib+ DOM-Based Cross-Site Scripting

Slug

supreme-modules-for-divi

Published

2024-05-31

Title

Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder < 2.5.52 - Authenticated (Contributor+) Stored Cross-Site Scripting