Skip to content
Sign in
Not rated

CVE-2021-24880 The SupportCandy WordPress plugin before 2.2.7 does not validate and escape the page attribute of its shortcode, which…

Description

The SupportCandy WordPress plugin before 2.2.7 does not validate and escape the page attribute of its shortcode, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks

Affected products and versions

Product Affected versions Fixed in
SupportCandy – Helpdesk & Support Ticket System 2.2 earliest → < 2.2.7 2.2.7

Other CVEs of SupportCandy – Helpdesk & Support Ticket System

The 5 CVEs of SupportCandy – Helpdesk & Support Ticket System →
CVE-2021-24879 The SupportCandy WordPress plugin before 2.2.7 does not have CSRF check in the wpsc_tickets AJAX action, nor has any… Not rated CVE-2021-24843 The SupportCandy WordPress plugin before 2.2.7 does not have CRSF check in its wpsc_tickets AJAX action, which could… Not rated CVE-2021-24878 The SupportCandy WordPress plugin before 2.2.7 does not sanitise and escape the query string before outputting it back… Not rated CVE-2021-24839 The SupportCandy WordPress plugin before 2.2.5 does not have authorisation and CSRF checks in its wpsc_tickets AJAX… Not rated
Track this CVE