SupportCandy WordPress Plugin XSS and SQLi

Time-based SQL injection in the SupportCandy - AI Customer Support Ticket System & Live Chatbot Agent WordPress plugin, affecting all versions up to and including 3.5.3, lets an authenticated attacker inject SQL through the unsanitized 'sort_by' parameter and use deliberate query delays to extract sensitive data from the site's database. Exploitation is gated by a non-default permission combination: the attacker must hold both a WordPress Subscriber-or-higher account and a SupportCandy Agent account explicitly granted the 'Assign Agents' capability, which confines the realistic threat to trusted-but-malicious or compromised agent accounts rather than anonymous visitors. Per CVSS 3.1 (6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) the impact is confidentiality-only, and no public exploit code was identified at time of analysis, with no CISA KEV listing.

Stored cross-site scripting in the SupportCandy WordPress plugin (all versions up to and including 3.5.3) lets an authenticated attacker holding only subscriber-level access plant arbitrary JavaScript via the 'name' parameter, which then executes in the browser of any administrator or support agent who later renders the affected admin or ticket page. Because the documented exploit chain depends on the 'Register user if not exists' option being disabled - the plugin's default state - most installations sit in the vulnerable configuration, though the attacker still needs a subscriber account and must wait for a privileged victim to view the injected content. Severity is moderate (CVSS 6.4, Medium) and consistent with a routine patch-management item; no public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV).