CVE-2021-24879

CVE-2021-24879 describes a Cross-Site Request Forgery (CSRF) vulnerability in the SupportCandy WordPress plugin prior to version 2.2.7. This flaw allows an attacker to trick a logged-in user with access to the ticket list dashboard into setting an arbitrary, malicious filter containing an XSS payload, which is then stored in their cookies. With a CVSS score of 8.8 (High), the vulnerability is easily exploitable via a network-based attack requiring user interaction, potentially leading to high impact on confidentiality, integrity, and availability. There is currently no evidence of active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this CVE.