CVE-2026-57711 Overview
CVE-2026-57711 is a stored Cross-Site Scripting (XSS) vulnerability in the PSM Plugins SupportCandy plugin for WordPress. The flaw affects all versions of SupportCandy up to and including 3.4.8. Attackers with low-privilege authenticated access can inject persistent JavaScript payloads that execute in the browsers of users who view the affected pages. The issue is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.
Critical Impact
Authenticated attackers can store malicious scripts in SupportCandy tickets or fields, leading to session hijacking, credential theft, or administrative account takeover when the payload executes in a privileged user's browser.
Affected Products
- PSM Plugins SupportCandy for WordPress, versions n/a through 3.4.8
- WordPress sites running the vulnerable SupportCandy helpdesk plugin
- Any environment where support agents or administrators render user-submitted ticket content
Discovery Timeline
- 2026-07-13 - CVE-2026-57711 published to the National Vulnerability Database
- 2026-07-13 - Last updated in NVD database
Technical Details for CVE-2026-57711
Vulnerability Analysis
The vulnerability is a stored XSS flaw in the SupportCandy WordPress helpdesk plugin. SupportCandy fails to properly neutralize user-supplied input before rendering it in HTML output. An authenticated user with low privileges can submit crafted content that persists in the plugin's database. When another user, typically a support agent or administrator, opens the affected ticket or view, the browser executes the attacker-controlled script in the site's origin.
Because the scope is changed, the injected script executes in a security context different from the vulnerable component. This enables attacks against WordPress administrators who authenticate through the same browser session. User interaction is required to trigger execution, but that interaction is limited to viewing the ticket.
The EPSS score is 0.161% with a percentile of 5.652, indicating that public exploitation activity has not been observed at scale.
Root Cause
The plugin does not apply sufficient output encoding or input sanitization on fields accepted from ticket submitters. Content flowing into the ticket rendering path retains HTML control characters and script tags, allowing arbitrary JavaScript to be stored and later reflected to viewers of the ticket.
Attack Vector
An attacker authenticates to the WordPress site with any account that can submit tickets or interact with SupportCandy fields. The attacker embeds a script payload inside a ticket subject, message body, or custom field. The payload is stored in the WordPress database. When a support agent or administrator opens the ticket in the SupportCandy dashboard, the browser executes the payload with the privileges of that user. Detailed vulnerability information is documented in the Patchstack WordPress Vulnerability Report.
Detection Methods for CVE-2026-57711
Indicators of Compromise
- Ticket records in the WordPress database containing <script>, onerror=, onload=, or javascript: sequences in SupportCandy-managed tables
- Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after opening a ticket
- New WordPress administrator accounts, modified user roles, or plugin installations following support agent activity
- Session cookies or nonces appearing in web server access logs of unrelated hosts
Detection Strategies
- Audit SupportCandy ticket content and custom field values for HTML tags or JavaScript event handlers using WordPress database queries
- Deploy Content Security Policy (CSP) reporting to capture inline script violations originating from the /wp-admin/ support views
- Monitor WordPress wp-content/plugins/supportcandy/ files for integrity changes and review access logs for anomalous POST requests to SupportCandy REST endpoints
Monitoring Recommendations
- Alert on WordPress admin session activity immediately followed by role changes, plugin installs, or option updates
- Track browser-generated requests to admin-ajax.php and SupportCandy AJAX actions from administrator accounts for unexpected referers
- Forward WordPress and web server logs to a centralized data lake and correlate ticket-view events with subsequent privileged actions
How to Mitigate CVE-2026-57711
Immediate Actions Required
- Upgrade SupportCandy to a version later than 3.4.8 as soon as the vendor publishes a patched release
- Restrict who can submit tickets and enforce strong role separation between ticket submitters and administrators
- Review recent tickets and custom field submissions for stored script payloads and sanitize or remove offending records
- Force password rotation and re-authentication for WordPress administrators who may have viewed malicious tickets
Patch Information
Refer to the Patchstack WordPress Vulnerability Report for current patch status and vendor advisories. Apply the vendor-supplied update through the WordPress plugin management interface once available.
Workarounds
- Deploy a Web Application Firewall (WAF) rule that blocks HTML tags and JavaScript event handlers in SupportCandy submission parameters
- Enforce a strict Content Security Policy that disallows inline scripts on WordPress administrative pages
- Temporarily disable the SupportCandy plugin if patched versions are not yet available and business risk warrants it
# Example CSP header for WordPress admin views (adjust to environment)
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
