9.8
Critical
CVE-2023-1730 The SupportCandy WordPress plugin before 3.1.5 does not validate and escape user input before using it in an SQL…
Description
The SupportCandy WordPress plugin before 3.1.5 does not validate and escape user input before using it in an SQL statement, which could allow unauthenticated attackers to perform SQL injection attacks
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| SupportCandy 3.1 | earliest → < 3.1.5 | 3.1.5 |
Other CVEs of SupportCandy
The 5 CVEs of SupportCandy →
CVE-2026-81022
The SupportCandy WordPress plugin before 3.5.3 does not validate a submitted per-ticket authorization code before…
5.3
Medium
CVE-2026-81021
The SupportCandy WordPress plugin before 3.5.3 does not perform an authorization check on one of its support-ticket…
5.3
Medium
CVE-2023-2805
The SupportCandy WordPress plugin before 3.1.7 does not properly sanitise and escape the agents[] parameter in the…
Not rated
CVE-2023-2719
The SupportCandy WordPress plugin before 3.1.7 does not properly sanitise and escape the `id` parameter for an Agent…
8.8
High