CVE-2026-94378

MediumCVSS 6.4/10Last modified Oct 6, 2026

Description

The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 3.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This exploit chain requires the 'Register user if not exists' setting to be disabled, which is its default configuration.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Oct 3, 2026
Last modified: Oct 6, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-943796.9The login() function in MISP's UsersController.php contained insufficient HTTP method validation for several security-critical code paths. T CVE-2026-94385.4A vulnerability was found in yashpokharna2555 StudentManagementSystem cb2f558ddf8d19396de0f92abf2d224d46a0a203. This impacts an unknown func CVE-2026-943818.7MISP has a security issue that can let a user gain more access than their API key is supposed to allow. A read-only API key should only let CVE-2026-943824.2Beszel before 0.19.0 contains an insecure direct object reference vulnerability in the POST and DELETE /api/beszel/user-alerts handlers that CVE-2026-943838.6The MISP blocklist workflow module accepted a user-supplied blocklist filename parameter without validating the file extension. The only san CVE-2026-943848.1Missing authorization in Amazon amazon-connect-salesforce-lambda before 5.26 allows any IAM principal with lambda:InvokeFunction permission CVE-2026-943875.4Aureus ERP before 1.6.0 contains a stored cross-site scripting vulnerability in the Chatter field-change log where old_value and new_value e CVE-2026-943889.3Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in halfdata Green Popups halfdata-green-p CVE-2026-943899.0Unauthenticated Remote Code Execution (RCE) in AcyMailing SMTP Newsletter <= 11.0.5 versions.CVE-2026-94396.3A vulnerability was determined in Edimax BR-6675nD 1.12. Affected is the function stainfo of the file /goform/stainfo. This manipulation of CVE-2026-943907.2Editor PHP Object Injection in Hide Shipping Method For WooCommerce <= 1.5.4 versions.CVE-2026-943916.5Contributor Cross Site Scripting (XSS) in Ultimate FAQ <= 2.4.14 versions.