Skip to content
Sign in
Not rated

CVE-2021-24807 The Support Board WordPress plugin before 3.3.5 allows Authenticated (Agent+) users to perform Cross-Site Scripting…

Description

The Support Board WordPress plugin before 3.3.5 allows Authenticated (Agent+) users to perform Cross-Site Scripting attacks by placing a payload in the notes field, when an administrator or any authenticated user go to the chat the XSS will be automatically executed.

Affected products and versions

Product Affected versions Fixed in
Support Board 3.3 earliest → < 3.3.5 3.3.5

Other CVEs of Support Board

The 3 CVEs of Support Board →
CVE-2021-24823 The Support Board WordPress plugin before 3.3.6 does not have any CSRF checks in actions handled by the include/ajax.php… Not rated CVE-2021-24741 The Support Board WordPress plugin before 3.3.4 does not escape multiple POST parameters (such as status_code,… Not rated
Track this CVE