CVE-2021-24807

Support Board < 3.3.5 - Agent+ Stored Cross-Site Scripting

Severity Score

5.4

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

The Support Board WordPress plugin before 3.3.5 allows Authenticated (Agent+) users to perform Cross-Site Scripting attacks by placing a payload in the notes field, when an administrator or any authenticated user go to the chat the XSS will be automatically executed.

El plugin Support Board de WordPress versiones anteriores a 3.3.5, permite a usuarios autenticados (Agente+) llevar a cabo ataques de tipo Cross-Site Scripting al colocar un payload en el campo notes, cuando un administrador o cualquier usuario autenticado vaya al chat el ataque de tipo XSS será ejecutado automáticamente

*Credits: John Jefferson Li

CVSS Scores

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Attack Vector

Network

Attack Complexity

Medium

Authentication

Single

Confidentiality

None

Integrity

Partial

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2021-01-14 CVE Reserved
2021-10-07 CVE Published
2021-10-07 First Exploit
2024-08-03 CVE Updated
2025-05-04 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CAPEC

References (4)

URL	Tag	Source
https://medium.com/%40lijohnjefferson/cve-2021-24807-6bc22af2a444	X_refsource_misc

URL	Date	SRC
https://github.com/dldygnl/CVE-2021-24807	2021-10-07
https://github.com/itsjeffersonli/CVE-2021-24807	2024-08-03
https://wpscan.com/vulnerability/19d101aa-4b60-4db4-a33b-86c826b288b0	2024-08-03

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Schiocco Search vendor "Schiocco"		Support Board Search vendor "Schiocco" for product "Support Board"				< 3.3.5 Search vendor "Schiocco" for product "Support Board" and version " < 3.3.5"		wordpress		Affected