CVE Intelligence

Psmplugins SupportCandy vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Psmplugins SupportCandy: 4 record(s), with affected versions and fixes.

CVE-2026-57711 Medium · 6.5 CWE-79 Jul 13, 2026
WordPress SupportCandy plugin <= 3.4.8 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PSM Plugins SupportCandy supportcandy allows Stored XSS.This issue affects SupportCandy: from n/a through <= 3.4.8.
CVE-2026-54826 High · 7.6 CWE-639 Jun 26, 2026
WordPress SupportCandy plugin <= 3.4.6 - Insecure Direct Object References (IDOR) vulnerability
Subscriber Insecure Direct Object References (IDOR) in SupportCandy <= 3.4.6 versions.
CVE-2026-25321 Medium · 5.3 CWE-862 Feb 19, 2026
WordPress SupportCandy plugin <= 3.4.4 - Broken Access Control vulnerability
Missing Authorization vulnerability in PSM Plugins SupportCandy supportcandy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SupportCandy: from n/a through <= 3.4.4.
CVE-2025-67598 Medium · 4.3 CWE-352 Dec 9, 2025
WordPress SupportCandy plugin <= 3.4.1 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in PSM Plugins SupportCandy supportcandy allows Cross Site Request Forgery.This issue affects SupportCandy: from n/a through <= 3.4.1.