Not rated
CVE-2021-24878 The SupportCandy WordPress plugin before 2.2.7 does not sanitise and escape the query string before outputting it back…
Description
The SupportCandy WordPress plugin before 2.2.7 does not sanitise and escape the query string before outputting it back in pages with the [wpsc_create_ticket] shortcode embed, leading to a Reflected Cross-Site Scripting issue
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| SupportCandy – Helpdesk & Support Ticket System 2.2 | earliest → < 2.2.7 | 2.2.7 |
Other CVEs of SupportCandy – Helpdesk & Support Ticket System
The 5 CVEs of SupportCandy – Helpdesk & Support Ticket System →
CVE-2021-24880
The SupportCandy WordPress plugin before 2.2.7 does not validate and escape the page attribute of its shortcode, which…
Not rated
CVE-2021-24879
The SupportCandy WordPress plugin before 2.2.7 does not have CSRF check in the wpsc_tickets AJAX action, nor has any…
Not rated
CVE-2021-24843
The SupportCandy WordPress plugin before 2.2.7 does not have CRSF check in its wpsc_tickets AJAX action, which could…
Not rated
CVE-2021-24839
The SupportCandy WordPress plugin before 2.2.5 does not have authorisation and CSRF checks in its wpsc_tickets AJAX…
Not rated