https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2023-2805.htmlhttps://patchthecve.com/cve/CVE-2023-2805.htmlWed, 17 Jun 2026 05:53:29 +0000HIGH 7.2: The SupportCandy WordPress plugin before 3.1.7 does not properly sanitise and escape the agents[] parameter in the set_add_agent_leaves AJAX function before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.https://patchthecve.com/cve/CVE-2023-2719.htmlhttps://patchthecve.com/cve/CVE-2023-2719.htmlWed, 17 Jun 2026 05:53:16 +0000HIGH 8.8: The SupportCandy WordPress plugin before 3.1.7 does not properly sanitise and escape the `id` parameter for an Agent in the REST API before using it in an SQL statement, leading to an SQL Injection exploitable by users with a role as low as Subscriber.https://patchthecve.com/cve/CVE-2023-1730.htmlhttps://patchthecve.com/cve/CVE-2023-1730.htmlWed, 17 Jun 2026 05:28:37 +0000CRITICAL 9.8: The SupportCandy WordPress plugin before 3.1.5 does not validate and escape user input before using it in an SQL statement, which could allow unauthenticated attackers to perform SQL injection attacks