PSM Plugins CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM PSM Plugins CVE published 2026-07-13

CVE-2026-57711

The SupportCandy plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS). This vulnerability affects SupportCandy versions up to and including 3.4.8. An attacker with low privileges can inject malicious scripts, potentially leading to unauthorized actions and data exposure. The vulnerability is rated as MEDIUM with a CVSS score of 6.5. Users of SupportCandy plugin versions up to 3.4.8 shou [truncated]

HIGH PSM Plugins CVE published 2026-06-26

CVE-2026-54826

CVE-2026-54826 is a HIGH-severity vulnerability in SupportCandy plugin versions <= 3.4.6, allowing Subscriber Insecure Direct Object References (IDOR). The CVSS score is 7.6. The vulnerability was published on 2026-06-26T15:16:40.350Z and last modified on 2026-06-29T18:16:37.700Z. The CVE record and NVD detail pages provide official information. A mitigation reference from Patchstack is available.