Stored Cross-Site Scripting in SupportCandy Plugin for WordPress

CVE-2026-94378

What is CVE-2026-94378?

The SupportCandy plugin for WordPress suffers from a Stored Cross-Site Scripting vulnerability due to inadequate input validation and output encoding within the 'name' parameter. This flaw allows authenticated attackers with subscriber-level access to inject malicious scripts into pages viewed by users, which could lead to significant security breaches. Notably, this vulnerability is triggered when the 'Register user if not exists' feature is disabled, which is the default configuration. It's crucial for users of this plugin to apply necessary security practices and updates to mitigate potential risks.

References