The SupportCandy WordPress plugin before 2.2.7 does not sanitise and escape the query string before outputting it back in pages with the wpsc_create_ticket shortcode embed leading to a Reflected Cross-Site Scripting issue