3.1.5

DATE	CVE	VULNERABILITY TITLE	RISK
2023-06-19	CVE-2023-2719	Unspecified vulnerability in Supportcandy The SupportCandy WordPress plugin before 3.1.7 does not properly sanitise and escape the `id` parameter for an Agent in the REST API before using it in an SQL statement, leading to an SQL Injection exploitable by users with a role as low as Subscriber. network low complexity supportcandy	8.8
2023-06-19	CVE-2023-2805	Unspecified vulnerability in Supportcandy The SupportCandy WordPress plugin before 3.1.7 does not properly sanitise and escape the agents[] parameter in the set_add_agent_leaves AJAX function before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin. network low complexity supportcandy	7.2