psmplugins vulnerabilities
6 published CVEs name psmplugins among the affected products.
- 6Published CVEs6 of them scored
- 4Last 12 monthspublished in the last year
- 0Critical0 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-94539
SupportCandy <= 3.5.3 - Authenticated (Custom+) SQL Injection via 'sort_by' Parameter
psmplugins · SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent
Medium6.5 - CVE-2026-94378
SupportCandy <= 3.5.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'name' Parameter
psmplugins · SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent
Medium6.4 - CVE-2026-1251
SupportCandy – Helpdesk & Customer Support Ticket System <= 3.4.4 - Authenticated (Subscriber+) Insecure Direct Object Reference
psmplugins · SupportCandy – Helpdesk & Customer Support Ticket System
Medium5.4 - CVE-2026-0683
SupportCandy – Helpdesk & Customer Support Ticket System <= 3.4.4 - Authenticated (Subscriber+) SQL Injection via Number Field Filter
psmplugins · SupportCandy – Helpdesk & Customer Support Ticket System
Medium6.5 - CVE-2025-10658
SupportCandy – Helpdesk & Customer Support Ticket System <= 3.3.7 - Authentication Bypass to Support Session Takeover
psmplugins · SupportCandy – Helpdesk & Customer Support Ticket System
Medium6.5 - CVE-2024-13552
SupportCandy – Helpdesk & Customer Support Ticket System <= 3.3.0 - Insecure Direct Object Reference
psmplugins · SupportCandy – Helpdesk & Customer Support Ticket System
Medium4.3