What is the CVSS score of CVE-2026-57711?

CVE-2026-57711 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

SupportCandy CVE-2026-57711

EUVD-2026-43366 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-13 Patchstack

WordPress XSS Wordpress Plugin Supportcandy

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

5.4 MEDIUM

AV:N and AC:L confirmed by web delivery; PR:L because ticket submission requires a user account; UI:R for admin to view ticket; S:C for browser scope change; A:N as XSS does not typically cause availability impact absent specific DoS behavior.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 11:21 vuln.today

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PSM Plugins SupportCandy supportcandy allows Stored XSS.This issue affects SupportCandy: from n/a through <= 3.4.8.

AnalysisAI

Stored cross-site scripting in the SupportCandy WordPress plugin (versions through 3.4.8) allows a low-privileged authenticated attacker to inject persistent malicious scripts that execute in the browser of any user - likely an administrator or support agent - who subsequently views the tainted content. The scope change (S:C in CVSS) reflects that injected script breaks out of the plugin's trust boundary and runs in the victim's full browser session, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code has been identified at time of analysis, and the vulnerability has not been listed in the CISA Known Exploited Vulnerabilities catalog.

Technical ContextAI

SupportCandy (CPE: cpe:2.3:a:psm_plugins:supportcandy:*:*:*:*:*:*:*:*) is a customer support ticket management plugin for WordPress developed by PSM Plugins. The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the Stored variant, meaning attacker-controlled input is persisted to the database and later reflected into rendered HTML without sufficient output encoding or escaping. In a WordPress context, this typically manifests in ticket submission fields, custom field inputs, or reply bodies that are stored and then displayed in the WordPress admin dashboard or front-end ticket views. The S:C (Scope Changed) CVSS metric confirms the script executes in a different security context - the victim's browser - than where the input was originally submitted.

RemediationAI

Administrators should update the SupportCandy plugin to a version above 3.4.8 immediately; the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/supportcandy/vulnerability/wordpress-supportcandy-plugin-3-4-8-cross-site-scripting-xss-vulnerability?_s_id=cve should be consulted for the specific patched release version, which was not explicitly stated in the available input data. If an immediate upgrade is not possible, a compensating control is to restrict ticket submission access to trusted users only, reducing the pool of potential attackers who hold the required low-privilege role. Additionally, deploying a Web Application Firewall rule targeting XSS payloads in ticket submission endpoints can reduce - but not eliminate - exploitation risk. Site administrators should also review audit logs for any unusual admin-session activity originating from ticket viewing pages. Note: restricting ticket submission may degrade the core functionality of the plugin as a customer-facing support tool.