SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent

80 Quality Score

Active Installs

18/30

With 10,000 active installs it has a real user base but trails Chatway at 30,000, so it is a respected mid-tier plugin rather than a category leader.

Update Freshness

25/25

Last updated June 2026 and tested against WordPress 7.0, which is about as current as you can ask for and earns a perfect score here.

User Rating

15/15

A 98 out of 100 from 288 reviewers is unusually strong and suggests the people who install it tend to stick with it.

Support Health

8/15

Only 1 support thread exists on the repository and it is resolved, which is good on paper but the sample size is too small to draw real conclusions about responsiveness under load.

WP Compatibility

15/15

Requires PHP 7.4 and WordPress 5.6, a reasonable baseline that covers the vast majority of hosting environments in 2026.

Scores higher than 79% of indexed plugins

About

Enhance your WordPress site with our AI Powered customer support ticket system. Manage customer support, tickets, and email tickets efficiently.

Active Installs 10k+

Rating ★★★★½ 4.9/5

Last Updated 2026-09-01 6:28am GMT

Requires WordPress 5.6+

Tested Up To 7.1

Requires PHP 7.4+

Security History

22 known vulnerabilities, all patched

2 Critical 3 High 17 Medium

Most recent: September 9, 2026

View details ▸

SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent 3.3.6 - 3.5.2 - Unauthenticated Information Exposure Medium

September 9, 2026 Patched in ["3.5.3"] CVE-2026-81022

SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent 3.2.9 - 3.5.2 - Unauthenticated Ticket Attachment Read Medium

September 7, 2026 Patched in ["3.5.3"] CVE-2026-81021

SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent <= 3.5.1 - Missing Authorization Medium

August 18, 2026 Patched in ["3.5.2"] CVE-2026-73350

SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent <= 3.4.8 - Authenticated (Customer+) Stored Cross-Site Scripting Medium

July 10, 2026 Patched in ["3.4.9"] CVE-2026-57711

SupportCandy – Helpdesk & Customer Support Ticket System <= 3.4.6 - Authenticated (Subscriber+) Insecure Direct Object Reference Medium

June 17, 2026 Patched in ["3.4.7"] CVE-2026-54826

SupportCandy – Helpdesk & Customer Support Ticket System <= 3.4.4 - Authenticated (Subscriber+) SQL Injection via Number Field Filter Medium

January 30, 2026 Patched in ["3.4.5"] CVE-2026-0683

SupportCandy – Helpdesk & Customer Support Ticket System <= 3.4.4 - Missing Authorization Medium

January 29, 2026 Patched in ["3.4.5"] CVE-2026-25321

SupportCandy – Helpdesk & Customer Support Ticket System <= 3.4.4 - Authenticated (Subscriber+) Insecure Direct Object Reference Medium

January 23, 2026 Patched in ["3.4.5"] CVE-2026-1251

SupportCandy <= 3.4.1 - Cross-Site Request Forgery Medium

November 21, 2025 Patched in ["3.4.2"] CVE-2025-67598

SupportCandy – Helpdesk & Customer Support Ticket System <= 3.3.7 - Authentication Bypass to Support Session Takeover Medium

September 19, 2025 Patched in ["3.3.8"] CVE-2025-10658

SupportCandy – Helpdesk & Customer Support Ticket System <= 3.3.0 - Insecure Direct Object Reference Medium

March 6, 2025 Patched in ["3.3.1"] CVE-2024-13552

SupportCandy <= 3.2.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting Medium

March 15, 2024 Patched in ["3.2.4"] CVE-2024-27991

SupportCandy <= 3.1.6 - Authenticated (Admin+) SQL Injection High

May 22, 2023 Patched in ["3.1.7"] CVE-2023-2805

SupportCandy <= 3.1.6 - Authenticated (Subscriber+) SQL Injection High

May 22, 2023 Patched in ["3.1.7"] CVE-2023-2719

SupportCandy <= 3.1.4 - Unauthenticated SQL Injection via parse_user_filters Critical

April 10, 2023 Patched in ["3.1.5"] CVE-2023-1730

SupportCandy <= 3.1.3 - Sensitive Data Exposure Medium

March 28, 2023 Patched in ["3.1.4"]

SupportCandy – Helpdesk & Support Ticket System <= 2.2.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting Medium

January 5, 2022 Patched in ["2.2.7"] CVE-2021-24879

SupportCandy <= 2.2.6 - Reflected Cross-Site Scripting Medium

January 5, 2022 Patched in ["2.2.7"] CVE-2021-24878

SupportCandy <= 2.2.4 - Unauthenticated Arbitrary Ticket Deletion High

January 5, 2022 Patched in ["2.2.5"] CVE-2021-24839

SupportCandy <= 2.2.6 - Cross-Site Request Forgery to Arbitrary Ticket Deletion Medium

January 4, 2022 Patched in ["2.2.7"] CVE-2021-24843

SupportCandy <= 2.2.6 - Stored Cross-Site Scripting via Shortcode Medium

January 4, 2022 Patched in ["2.2.7"] CVE-2021-24880

SupportCandy – Helpdesk & Support Ticket System <= 2.0.0 - Arbitrary File Upload Critical

April 17, 2019 Patched in ["2.0.1"] CVE-2019-11223

What It Does

SupportCandy turns a WordPress site into a helpdesk where customers can submit tickets through the front end and staff can manage, reply to, and assign them from the back end. It handles email piping so incoming emails become trackable tickets, and the AI chatbot agent handles first-line automated responses. The goal is to keep all customer support conversations inside WordPress rather than paying for a separate SaaS like Zendesk or Freshdesk.

Who It's For

Small to mid-sized businesses running their operations on WordPress who want a full ticket workflow, agent assignments, and email integration without sending customer data to third-party platforms. It fits support teams of one to roughly ten agents handling dozens of tickets a day. It is less aimed at enterprise IT departments and more at agencies, SaaS founders, and WooCommerce stores.

Who Should Skip It

If you only need a quick live chat widget for sales conversations, this is heavier than necessary and Chatway will get you running faster. Sites stuck on PHP older than 7.4 or WordPress before 5.6 cannot run it at all.

The Bottom Line

SupportCandy is a well-maintained, highly rated helpdesk plugin with a quality score of 80.11 out of 100, and for most WordPress-based support teams it will do the job without sending customers to an external tool. The main caveat is the small public support footprint and modest install count compared with Chatway, so if your business depends on a massive community for answers you may want to validate that with the developer first.

Pick Chatway if your priority is fast, friction-free live chat with an AI bot and you do not need a deep ticketing workflow.

MxChat – AI Chatbot & Content Generation for WordPress 82/100

Pick MxChat when you want AI chat plus AI-assisted content creation rather than a structured ticketing system.

WP Debugging 80/100

WP Debugging is not a real alternative here since it only handles error logging, but it shares the 10,000-install tier.

LiveChat – Live Chat Plugin for WP Websites 79/100

Pick the LiveChat plugin if you specifically want the LiveChat SaaS brand integrated into WordPress and are willing to pay for it.

Fluent Support – Helpdesk & Customer Support Ticket System 79/100

Pick Fluent Support if you are already running other Fluent plugins and want a helpdesk that fits that ecosystem, especially for WooCommerce order tickets.