CVE-2024-27991

WordPress SupportCandy plugin <= 3.2.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SupportCandy allows Stored XSS.This issue affects SupportCandy: from n/a through 3.2.3.

We have discovered 428 live websites that are affected by CVE-2024-27991.

Run a Free Instant Scan



Affected Software

Product  Supportcandy
Category Wordpress Plugins
Vulnerable Domains428 live websites (21% of Supportcandy install base)
Vulnerable Versions
  • from 0 through 3.2.3
Vulnerable Versions Count32 versions ( 62% of all versions)


Common Weakness Enumeration

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')



Details

  • Published - Mar 21, 2024
  • Updated - Aug 2, 2024

Credits

  • Mochamad Sofyan (Patchstack Alliance) (finder)

Website Distribution by Country

Number of websites using CVE-2024-27991
United States96 websites


Italy47 websites
Germany36 websites
Iran28 websites
Russia23 websites
France21 websites
GB20 websites
Brazil19 websites
Spain13 websites
Australia11 websites

Website Distribution by TLD

Number of websites using CVE-2024-27991
.com155 websites
.it35 websites
.ru21 websites
.com.br19 websites
.net12 websites
.org12 websites
.de12 websites
.pl7 websites
.eu6 websites
.es6 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2024-27991

Top websites that are affected by CVE-2024-27991. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
*****.app Bulgaria**,***
****************.com GB**,***
********.pt United States**,***
*****.sv El Salvador***,***
*****************.com United States***,***
***********.com United States***,***
*********.com United States***,***
*********.de Germany***,***
************.***.au Australia***,***
************.com United States***,***
See full domain list

FAQ

CVE-2024-27991 is Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Supportcandy
A total of 428 websites have been identified as vulnerable to CVE-2024-27991, based on global website indexing conducted by WebTechSurvey.
The Supportcandy is affected by the CVE-2024-27991 vulnerability.
Supportcandy versions up to and including 3.2.3 are vulnerable to CVE-2024-27991.