8.8
High
CVE-2023-2719 The SupportCandy WordPress plugin before 3.1.7 does not properly sanitise and escape the `id` parameter for an Agent…
Description
The SupportCandy WordPress plugin before 3.1.7 does not properly sanitise and escape the `id` parameter for an Agent in the REST API before using it in an SQL statement, leading to an SQL Injection exploitable by users with a role as low as Subscriber.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| SupportCandy 3.1 | earliest → < 3.1.7 | 3.1.7 |
Other CVEs of SupportCandy
The 5 CVEs of SupportCandy →
CVE-2026-81022
The SupportCandy WordPress plugin before 3.5.3 does not validate a submitted per-ticket authorization code before…
5.3
Medium
CVE-2026-81021
The SupportCandy WordPress plugin before 3.5.3 does not perform an authorization check on one of its support-ticket…
5.3
Medium
CVE-2023-2805
The SupportCandy WordPress plugin before 3.1.7 does not properly sanitise and escape the agents[] parameter in the…
Not rated
CVE-2023-1730
The SupportCandy WordPress plugin before 3.1.5 does not validate and escape user input before using it in an SQL…
9.8
Critical