CVE-2021-24807 Support Board < 3.3.5 - Agent+ Stored Cross-Site Scripting

2021-11-0817:35:25

CWE-79

WPScan

www.cve.org

support board

plugin

cross-site scripting

authenticated users

agent+

EPSS

0.001

Percentile

26.9%

JSON

The Support Board WordPress plugin before 3.3.5 allows Authenticated (Agent+) users to perform Cross-Site Scripting attacks by placing a payload in the notes field, when an administrator or any authenticated user go to the chat the XSS will be automatically executed.

CNA Affected

[
  {
    "product": "Support Board",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "3.3.5",
        "status": "affected",
        "version": "3.3.5",
        "versionType": "custom"
      }
    ]
  }
]