Skip to content
PluginCanary

SupportCandy - Helpdesk, Support Ticket System & AI Chatbot

by PSM Plugins · 10,000+ active installs · Checked 3 Nov 2026
Healthy5 Warnings

Healthy: vulnerability published 2 Oct 2026, fixed in 3.5.4.

81/ 100 Canary Score
Sub-scores for SupportCandy - Helpdesk, Support Ticket System & AI Chatbot
Ownership100
Maintenance100
Security60
Support70
Reputation70

How the score works

Active signals

Facts we detected, with links to the source.

  • WarningSEC-1Vulnerability published 2 Oct 2026, fixed in 3.5.4. Update to version 3.5.4 or later.2 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 2 Oct 2026, fixed in 3.5.4. Update to version 3.5.4 or later.2 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 9 Sep 2026, fixed in 3.5.3. Update to version 3.5.3 or later.9 Sep 2026Evidence
  • WarningSEC-1Vulnerability published 7 Sep 2026, fixed in 3.5.3. Update to version 3.5.3 or later.7 Sep 2026Evidence
  • WarningSEC-1Vulnerability published 18 Aug 2026, fixed in 3.5.2. Update to version 3.5.2 or later.18 Aug 2026Evidence
  • InfoSEC-313 vulnerabilities published in the last 24 months. Review this plugin.4 Nov 2026Evidence

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
supportcandy15 Aug 2018 to 16 Apr 2025, 128 commits
psmplugins14 Jul 2025 to 3 Nov 2026, 29 commits

2 committers recorded. No ownership changes recorded since 3 Nov 2026.

Maintenance

Last release
yesterday
Releases, 24 months
56
Tested up to
7.1 current
Requires PHP
7.4 supported 8.2+
Releases per quarter for SupportCandy - Helpdesk, Support Ticket System & AI Chatbot
Q1 20240
Q2 20240
Q3 20240
Q4 20240
Q1 20250
Q2 20250
Q3 202540
Q4 20255
Q1 20262
Q2 20264
Q3 20264
Q4 20261

Last release 3 Nov 2026. Tested with WordPress 7.1 (current).

Support

100% of 2 support threads resolved in the last 2 months.

Security record

PublishedIssueCVSSAffectedFixed inDays to patch
2 Oct 2026SupportCandy <= 3.5.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'name' Parameter6.4<= 3.5.33.5.40
2 Oct 2026SupportCandy <= 3.5.3 - Authenticated (Custom+) SQL Injection via 'sort_by' Parameter6.5<= 3.5.33.5.40
9 Sep 2026SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent 3.3.6 - 3.5.2 - Unauthenticated Information Exposure5.33.3.6 to 3.5.23.5.30
7 Sep 2026SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent 3.2.9 - 3.5.2 - Unauthenticated Ticket Attachment Read5.33.2.9 to 3.5.23.5.30
18 Aug 2026SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent <= 3.5.1 - Missing Authorization5.3<= 3.5.13.5.20
10 Jul 2026SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent <= 3.4.8 - Authenticated (Customer+) Stored Cross-Site Scripting6.4<= 3.4.83.4.90
17 Jun 2026SupportCandy – Helpdesk & Customer Support Ticket System <= 3.4.6 - Authenticated (Subscriber+) Insecure Direct Object Reference4.3<= 3.4.63.4.70
30 Jan 2026SupportCandy – Helpdesk & Customer Support Ticket System <= 3.4.4 - Authenticated (Subscriber+) SQL Injection via Number Field Filter6.5<= 3.4.43.4.50
29 Jan 2026SupportCandy – Helpdesk & Customer Support Ticket System <= 3.4.4 - Missing Authorization5.3<= 3.4.43.4.50
23 Jan 2026SupportCandy – Helpdesk & Customer Support Ticket System <= 3.4.4 - Authenticated (Subscriber+) Insecure Direct Object Reference5.4<= 3.4.43.4.55
21 Nov 2025SupportCandy <= 3.4.1 - Cross-Site Request Forgery4.3<= 3.4.13.4.20
19 Sep 2025SupportCandy – Helpdesk & Customer Support Ticket System <= 3.3.7 - Authentication Bypass to Support Session Takeover6.5<= 3.3.73.3.80
6 Mar 2025SupportCandy – Helpdesk & Customer Support Ticket System <= 3.3.0 - Insecure Direct Object Reference4.3<= 3.3.03.3.1207
15 Mar 2024SupportCandy <= 3.2.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting6.4<= 3.2.33.2.4564
22 May 2023SupportCandy <= 3.1.6 - Authenticated (Admin+) SQL Injection7.2<= 3.1.63.1.7862
22 May 2023SupportCandy <= 3.1.6 - Authenticated (Subscriber+) SQL Injection8.8<= 3.1.63.1.7862
10 Apr 2023SupportCandy <= 3.1.4 - Unauthenticated SQL Injection via parse_user_filters9.8<= 3.1.43.1.5904
28 Mar 2023SupportCandy <= 3.1.3 - Sensitive Data Exposure6.5<= 3.1.33.1.4917
5 Jan 2022SupportCandy <= 2.2.4 - Unauthenticated Arbitrary Ticket Deletion7.5<= 2.2.42.2.5n/a
5 Jan 2022SupportCandy <= 2.2.6 - Reflected Cross-Site Scripting6.1<= 2.2.62.2.7n/a
5 Jan 2022SupportCandy – Helpdesk & Support Ticket System <= 2.2.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting6.1< 2.2.72.2.7n/a
4 Jan 2022SupportCandy <= 2.2.6 - Stored Cross-Site Scripting via Shortcode6.4< 2.2.72.2.7n/a
4 Jan 2022SupportCandy <= 2.2.6 - Cross-Site Request Forgery to Arbitrary Ticket Deletion6.5< 2.2.72.2.7n/a
17 Apr 2019SupportCandy – Helpdesk & Support Ticket System <= 2.0.0 - Arbitrary File Upload9.8< 2.0.12.0.1n/a

Source: Wordfence Intelligence.

Reputation

Average rating per quarter for SupportCandy - Helpdesk, Support Ticket System & AI Chatbot
Q2 20243.7
Q3 20245.0
Q4 20245.0
Q1 20255.0
Q2 20254.2
Q3 20255.0
Q4 20254.8
Q2 20265.0
Q3 20265.0

Average rating rose from 3.7 to 5.0 between Q2 2024 and Q3 2026.

Rating distribution
5 star271
4 star8
3 star3
2 star2
1 star5
Latest low reviews

Momentum

10,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for SupportCandy - Helpdesk, Support Ticket System & AI Chatbot
4 May 2026301
11 May 2026532
18 May 2026936
25 May 20264,645
1 Jun 20264,599
8 Jun 20261,329
15 Jun 20261,384
22 Jun 2026837
29 Jun 20264,448
6 Jul 20262,025
13 Jul 20261,033
20 Jul 2026703
27 Jul 20264,331
3 Aug 20261,778
10 Aug 20265,187
17 Aug 20261,734
24 Aug 20261,028
31 Aug 20264,926
7 Sep 20261,903
14 Sep 20261,588
21 Sep 20262,565
28 Sep 20265,370
5 Oct 20262,116
12 Oct 20261,405
19 Oct 20261,433
26 Oct 20261,739
2 Nov 2026182

Weekly downloads over the last 4 weeks are 47% below the 27-week average.

Healthier alternatives

Same category, higher Canary Score. Never sponsored.

No healthier plugin in the same category yet.

Facts

Version3.5.5
AuthorPSM Plugins
Added15 Aug 2018
Last updated3 Nov 2026
Active installs10,000+
Requires WordPress5.6
Tested up to7.1.4
Requires PHP7.4
CategorySupport & Help Desk > Help Desk & Ticketing Systems
Tagschatbot, helpdesk, ticket system, Support Ticket, customer support

Other plugins by this author: Multi Currency Switcher for WooCommerce, Request a Quote for WooCommerce

Questions

Is SupportCandy - Helpdesk, Support Ticket System & AI Chatbot still maintained?

SupportCandy - Helpdesk, Support Ticket System & AI Chatbot was last updated on 3 Nov 2026. Its Canary status is Healthy.

Is SupportCandy - Helpdesk, Support Ticket System & AI Chatbot safe?

SupportCandy - Helpdesk, Support Ticket System & AI Chatbot has no open unpatched vulnerabilities on record. 13 vulnerabilities were published in the last 24 months. Its Canary status is Healthy.

Who owns SupportCandy - Helpdesk, Support Ticket System & AI Chatbot?

The wordpress.org author is PSM Plugins. Recent committers: psmplugins, supportcandy, plugin-master. We have recorded no ownership change.

What can I use instead of SupportCandy - Helpdesk, Support Ticket System & AI Chatbot?

We have no healthier plugin in the same category on record yet.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews, Wordfence Intelligence.Plugin data refreshed 3 Nov 2026.Report a data issue