Non notée
CVE-2021-24878 The SupportCandy WordPress plugin before 2.2.7 does not sanitise and escape the query string before outputting it back…
Description
The SupportCandy WordPress plugin before 2.2.7 does not sanitise and escape the query string before outputting it back in pages with the [wpsc_create_ticket] shortcode embed, leading to a Reflected Cross-Site Scripting issue
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| SupportCandy – Helpdesk & Support Ticket System 2.2 | premières → < 2.2.7 | 2.2.7 |
Autres CVE de SupportCandy – Helpdesk & Support Ticket System
Les 5 CVE de SupportCandy – Helpdesk & Support Ticket System →
CVE-2021-24880
The SupportCandy WordPress plugin before 2.2.7 does not validate and escape the page attribute of its shortcode, which…
Non notée
CVE-2021-24879
The SupportCandy WordPress plugin before 2.2.7 does not have CSRF check in the wpsc_tickets AJAX action, nor has any…
Non notée
CVE-2021-24843
The SupportCandy WordPress plugin before 2.2.7 does not have CRSF check in its wpsc_tickets AJAX action, which could…
Non notée
CVE-2021-24839
The SupportCandy WordPress plugin before 2.2.5 does not have authorisation and CSRF checks in its wpsc_tickets AJAX…
Non notée