Known CVE

SupportCandy < 2.2.7 - Reflected Cross-Site Scripting

The SupportCandy WordPress plugin before 2.2.7 does not sanitise and escape the query string before outputting it back in pages with the [wpsc_create_ticket] shortcode embed, leading to a Reflected Cross-Site Scripting issue

CVE-2021-24878

Medium2021CVSS 6.1CWE-79

cve2021 · wordpress · wpscan · wp-plugin · supportcandy · xss · vkev · vuln

Verified scans run this check after you prove you own the site.

All known CVEs View the checks catalog National Vulnerability Database

Scan a website