CVE-2026-94378 Overview
The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the name parameter. The flaw affects all versions up to and including 3.5.3 and stems from insufficient input sanitization and output escaping [CWE-79]. Authenticated attackers with subscriber-level access or above can inject arbitrary web scripts that execute when any user visits an affected page. Exploitation requires the Register user if not exists setting to be disabled, which is the default configuration.
Critical Impact
Authenticated subscribers can plant persistent JavaScript payloads that execute in the browsers of administrators and site visitors, enabling session hijacking, privilege escalation workflows, and content redirection.
Affected Products
- SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress
- All versions up to and including 3.5.3
- WordPress sites with the Register user if not exists setting in default (disabled) state
Discovery Timeline
- 2026-10-03 - CVE-2026-94378 published to the National Vulnerability Database
- 2026-10-06 - Last updated in NVD database
Technical Details for CVE-2026-94378
Vulnerability Analysis
The vulnerability is a stored XSS flaw in the SupportCandy ticketing plugin. The name parameter is persisted to the database and later rendered in administrative and customer-facing pages without proper escaping. An authenticated user at subscriber level can submit a crafted name value containing JavaScript. When an administrator, agent, or other user loads a page that renders the stored value, the injected script executes in that user's browser session. Because the payload is stored, every subsequent view of the affected page triggers execution, extending the attack surface to any authenticated viewer.
Root Cause
The plugin fails to sanitize the name input on write and does not escape it on output. The affected rendering paths include the recent activities log (class-wpsc-ra-logs.php), the agent-created custom field type (class-wpsc-df-agent-created.php), and the customer custom field type (class-wpsc-df-customer.php). The fix landed in SupportCandy Changeset 3718257, which introduces proper escaping on the vulnerable output paths.
Attack Vector
The attack vector is network-based and requires low-privileged authentication. A subscriber-level account submits a crafted customer name through the plugin's ticketing workflow. The payload persists in plugin tables and executes when staff or other users render pages that display the stored field. Because the scope is changed (S:C), the injected script runs in the trust context of the viewing user, including administrators, enabling actions such as cookie theft, forced requests to admin endpoints, or defacement of rendered content. See the Wordfence Vulnerability Analysis for additional technical context.
Detection Methods for CVE-2026-94378
Indicators of Compromise
- Customer or ticket records containing HTML or JavaScript tags such as <script>, onerror=, onload=, or javascript: within the name field.
- Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after loading SupportCandy admin pages.
- New administrator accounts, modified user roles, or plugin configuration changes with no corresponding admin activity in audit logs.
Detection Strategies
- Query the WordPress database for SupportCandy custom field entries whose name values contain angle brackets, event handlers, or encoded script fragments.
- Deploy a web application firewall rule that inspects POST parameters submitted to SupportCandy endpoints for XSS payload patterns.
- Review web server access logs for subscriber accounts submitting unusually large or encoded name values to ticket creation endpoints.
Monitoring Recommendations
- Monitor WordPress audit logs for subscriber-role users interacting with SupportCandy ticket workflows.
- Alert on administrator sessions that generate anomalous XHR or fetch traffic immediately after viewing SupportCandy admin screens.
- Track plugin version inventory across managed WordPress sites to confirm all instances are above 3.5.3.
How to Mitigate CVE-2026-94378
Immediate Actions Required
- Update the SupportCandy plugin to the version containing Changeset 3718257 or later.
- Audit all existing SupportCandy customer and ticket records for stored script payloads and sanitize or remove suspicious entries.
- Rotate credentials and session tokens for any administrator or agent who may have viewed malicious content.
Patch Information
The vendor addressed the issue in a release following version 3.5.3. The fix, published in SupportCandy Changeset 3718257, adds proper output escaping to the affected customer field rendering paths. Reference source files include class-wpsc-ra-logs.php, class-wpsc-df-agent-created.php, and class-wpsc-df-customer.php.
Workarounds
- Restrict new user registration and limit subscriber-level account creation until the patch is applied.
- Enforce a Content Security Policy that blocks inline script execution on WordPress admin and ticket pages.
- Place the WordPress site behind a web application firewall configured to filter XSS payloads in SupportCandy request parameters.
# Configuration example
wp plugin update supportcandy
wp plugin get supportcandy --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
