https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T11:30:46.561681+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2021-24879 CVE-2021-24879 — SupportCandy < 2.2.7 - CSRF to Cross-Site Scripting 2026-10-06T11:30:46.579424+00:00

Affected: Unknown SupportCandy – Helpdesk & Support Ticket System

The SupportCandy WordPress plugin before 2.2.7 does not have CSRF check in the wpsc_tickets AJAX action, nor has any sanitisation or escaping in some of the filter fields which could allow attackers to make a logged in user having access to the ticket lists dashboard set an arbitrary filter (stored in their cookies) with an XSS payload in it.