CVE-2026-94378

Name of the Vulnerable Software and Affected Versions SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent versions prior to 3.5.4

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access or higher can inject arbitrary web scripts via the name parameter. These scripts execute when a user accesses the affected page. This issue is exploitable when the 'Register user if not exists' setting is disabled, which is the default configuration.

Recommendations Update SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent to version 3.5.4 or later.