CVE-2026-94378 psmplugins CVE debrief

Who should care

Defenders responsible for WordPress installations with the SupportCandy plugin should assess exposure and prioritize updates. This includes reviewing plugin versions, user registration settings, and ensuring compensating controls are in place for exposed systems. Security teams and operators managing WordPress environments need to verify and mitigate this vulnerability to prevent potential exploitation.

Why it matters

CVE-2026-94378 is a Stored Cross-Site Scripting vulnerability in the SupportCandy plugin for WordPress. Defenders should prioritize verifying and updating the plugin to prevent exploitation, as attackers with subscriber-level access can inject malicious scripts.

• Attackers can inject malicious scripts, potentially leading to user session hijacking
• Injected scripts can execute on page access, allowing for unauthorized actions
• Exploitation requires authenticated access with subscriber-level permissions
• Verification of plugin version and user registration settings is necessary

Technical summary

The SupportCandy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 3.5.3. This is due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access and above can inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This exploit chain requires the 'Register user if not exists' setting to be disabled, which is its default configuration.

Defensive priority

Defenders should prioritize verifying and updating the SupportCandy plugin to prevent exploitation.

Recommended defensive actions

• Verify the SupportCandy plugin version and update to a patched version if necessary
• Restrict access to the plugin's settings and user registration features
• Monitor for suspicious activity and injected scripts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was reported by [email protected] and is detailed in multiple source references. The CVE record and NVD detail provide official information on the vulnerability. Additional source references from [email protected] offer further details on the plugin's code review and vulnerability assessment. The exploit requires authenticated access with subscriber-level permissions and specific configuration settings.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.