Advisories · Technology

SupportCandy.

Every CVE that names SupportCandy among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-81022 CVE record

CVSS 5.3 Medium

SupportCandy 3.3.6 - 3.5.2 - Unauthenticated Ticket Content Disclosure via Auth Code Leak
- SupportCandy
- Information disclosure
Not analysed yet 9 Sept 2026
CVE-2026-81021 CVE record

CVSS 5.3 Medium

SupportCandy 3.2.9 - 3.5.2 - Unauthenticated Ticket Attachment Disclosure
- SupportCandy
- Information disclosure
Not analysed yet 9 Sept 2026
CVE-2024-27991 CVE record

CVSS 6.5 Medium

WordPress SupportCandy plugin <= 3.2.3 - Cross Site Scripting (XSS) vulnerability
- SupportCandy
- Cross-site scripting (XSS)
Not analysed yet 21 Mar 2024
CVE-2023-2805 CVE record

SupportCandy < 3.1.7 - Admin+ SQLi
- SupportCandy
Not analysed yet 19 Jun 2023
CVE-2023-2719 CVE record

CVSS 8.8 High

SupportCandy < 3.1.7 - Subscriber+ SQLi
- SupportCandy
Not analysed yet 19 Jun 2023
CVE-2023-1730 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

SupportCandy < 3.1.5 - Unauthenticated SQLi
- SupportCandy
- SQL injection
Not analysed yet 2 May 2023