SupportCandy CVE-2026-94378

Requires an authenticated account with subscriber-level access or above on the target site (PR:L), and the SupportCandy plugin at version ≤3.5.3 with the stored-XSS sink in the 'name' parameter. The specific exploit chain requires the 'Register user if not exists' setting to be DISABLED - which is the plugin's default configuration, so most installations are in the vulnerable state rather than needing a non-default change. Exploitation is further gated by a privileged user (admin/agent) subsequently viewing the injected page for the payload to fire in their context; it is not remote-unauthenticated. Limiting factors: attacker must obtain a subscriber account, and impact depends on a higher-privileged victim rendering the stored content.

This is a moderate-severity stored XSS (CVSS 6.4, Medium) that should be treated as a routine patch-management item rather than an emergency. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C) indicates network-reachable, low-complexity injection requiring only subscriber-level authentication, with a scope change (S:C) reflecting that injected script executes in the context of other users' browsers - the classic stored-XSS escalation path. Impact is limited (C:L/I:L/A:N). No EPSS score, KEV listing, or public POC is present in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' The signals are internally consistent: a low-privilege authenticated flaw with partial impact and no evidence of active exploitation points to real-but-not-urgent risk. The one nuance worth flagging: the exploit chain is only viable when the 'Register user if not exists' setting is DISABLED - which the description states is the default - so most deployments are in the exploitable configuration, raising the practical likelihood above what a raw 6.4 might suggest. Confidence is tempered by the absence of EPSS/KEV/POC data to corroborate real-world interest.

An attacker who registers or obtains a subscriber-level account on a target WordPress site submits a support ticket or customer field containing a malicious script in the 'name' parameter, which SupportCandy stores without adequate sanitization. When an administrator or agent later views the ticket, recent-activities log, or affected page, the script executes in their authenticated browser session, enabling session/cookie theft or admin-context actions. No public exploit code was identified at time of analysis, but exploitation is low-complexity and requires no victim click beyond normal page viewing.