Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

SupportCandy — Vulnerabilities & Security Advisories 11

All 11 CVE vulnerabilities found in SupportCandy, with AI-generated Chinese analysis, references, and POCs.

Vendor: Unknown

CVE ID Title CVSS Severity Published
CVE-2026-81022 SupportCandy 3.3.6 - 3.5.2 - Unauthenticated Ticket Content Disclosure via Auth Code Leak - - 2026-09-09
CVE-2026-81021 SupportCandy 3.2.9 - 3.5.2 - Unauthenticated Ticket Attachment Disclosure - - 2026-09-09
CVE-2026-73350 WordPress SupportCandy plugin <= 3.5.1 - Broken Authentication vulnerability CWE-266 8.2 High 2026-08-18
CVE-2026-57711 WordPress SupportCandy plugin <= 3.4.8 - Cross Site Scripting (XSS) vulnerability CWE-79 6.5 Medium 2026-07-13
CVE-2026-54826 WordPress SupportCandy plugin <= 3.4.6 - Insecure Direct Object References (IDOR) vulnerability CWE-639 7.6 High 2026-06-26
CVE-2026-25321 WordPress SupportCandy plugin <= 3.4.4 - Broken Access Control vulnerability CWE-862 5.3 Medium 2026-02-19
CVE-2025-67598 WordPress SupportCandy plugin <= 3.4.1 - Cross Site Request Forgery (CSRF) vulnerability CWE-352 4.3 Medium 2025-12-09
CVE-2024-27991 WordPress SupportCandy plugin <= 3.2.3 - Cross Site Scripting (XSS) vulnerability CWE-79 6.5 Medium 2024-03-21
CVE-2023-2805 SupportCandy < 3.1.7 - Admin+ SQLi 7.2 - 2023-06-19
CVE-2023-2719 SupportCandy < 3.1.7 - Subscriber+ SQLi 8.8 - 2023-06-19
CVE-2023-1730 SupportCandy < 3.1.5 - Unauthenticated SQLi 9.8 - 2023-05-02

All 11 known CVE vulnerabilities affecting SupportCandy with full Chinese analysis, references, and POCs where available.