SupportCandy <= 3.5.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'name' Parameter

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-94378 · Microsoft / collected KEV context

cve-program · CVE-2026-94378

• https://www.wordfence.com/threat-intel/vulnerabilities/id/9703fa76-fd73-4cd8-aa41-8adcb55190be?source=cve
• https://plugins.trac.wordpress.org/browser/supportcandy/tags/3.5.3/includes/admin/recent-activities/class-wpsc-ra-logs.php#L207
• https://plugins.trac.wordpress.org/browser/supportcandy/tags/3.5.3/includes/custom-field-types/class-wpsc-df-customer.php#L464
• https://plugins.trac.wordpress.org/browser/supportcandy/tags/3.5.3/includes/custom-field-types/class-wpsc-df-customer.php#L681
• https://plugins.trac.wordpress.org/browser/supportcandy/tags/3.5.3/includes/custom-field-types/class-wpsc-df-agent-created.php#L492
• https://plugins.svn.wordpress.org/supportcandy/
• https://plugins.trac.wordpress.org/changeset/3718257/supportcandy/trunk/includes/custom-field-types/class-wpsc-df-customer.php

No related operational record is retained in the current change model.