Non notée
CVE-2021-24880 The SupportCandy WordPress plugin before 2.2.7 does not validate and escape the page attribute of its shortcode, which…
Description
The SupportCandy WordPress plugin before 2.2.7 does not validate and escape the page attribute of its shortcode, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| SupportCandy – Helpdesk & Support Ticket System 2.2 | premières → < 2.2.7 | 2.2.7 |
Autres CVE de SupportCandy – Helpdesk & Support Ticket System
Les 5 CVE de SupportCandy – Helpdesk & Support Ticket System →
CVE-2021-24879
The SupportCandy WordPress plugin before 2.2.7 does not have CSRF check in the wpsc_tickets AJAX action, nor has any…
Non notée
CVE-2021-24843
The SupportCandy WordPress plugin before 2.2.7 does not have CRSF check in its wpsc_tickets AJAX action, which could…
Non notée
CVE-2021-24878
The SupportCandy WordPress plugin before 2.2.7 does not sanitise and escape the query string before outputting it back…
Non notée
CVE-2021-24839
The SupportCandy WordPress plugin before 2.2.5 does not have authorisation and CSRF checks in its wpsc_tickets AJAX…
Non notée