CVE-2021-24741

The Support Board WordPress plugin before 3.3.4 does not escape multiple POST parameters (such as status_code, department, user_id, conversation_id, conversation_status_code, and recipient_id) before using them in SQL statements, leading to SQL injections which are exploitable by unauthenticated users.

• CWE-89

• https://board.support/changesRelease Notes, Vendor Advisory
• https://medium.com/%40lijohnjefferson/multiple-sql-injection-unauthenticated-in-support-board-v-3-3-3-3e9b4214a4f9
• https://wpscan.com/vulnerability/ccf293ec-7607-412b-b662-5e237b8690caExploit, Third Party Advisory
• https://board.support/changesRelease Notes, Vendor Advisory
• https://medium.com/%40lijohnjefferson/multiple-sql-injection-unauthenticated-in-support-board-v-3-3-3-3e9b4214a4f9
• https://wpscan.com/vulnerability/ccf293ec-7607-412b-b662-5e237b8690caExploit, Third Party Advisory

Published

Sep 20, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-24736The Easy Download Manager and File Sharing Plugin with front…4.8
• CVE-2021-24737The Comments – wpDiscuz WordPress plugin through 7.3.0 does …4.8
• CVE-2021-24738The Logo Carousel WordPress plugin before 3.4.2 does not val…5.4
• CVE-2021-24739The Logo Carousel WordPress plugin before 3.4.2 allows users…8.1
• CVE-2021-2474Vulnerability in the Oracle Web Analytics product of Oracle …8.1
• CVE-2021-24740The Tutor LMS WordPress plugin before 1.9.9 does not escape …4.8
• CVE-2021-24742The Logo Slider and Showcase WordPress plugin before 1.3.37 …6.5
• CVE-2021-24743The Podcast Subscribe Buttons WordPress plugin before 1.4.2 …5.4
• CVE-2021-24744The WordPress Contact Forms by Cimatti WordPress plugin befo…4.8
• CVE-2021-24745The About Author Box WordPress plugin before 1.0.2 does not …5.4
• CVE-2021-24746The Social Sharing Plugin WordPress plugin before 3.3.40 doe…6.1
• CVE-2021-24747The SEO Booster WordPress plugin before 3.8 allows for authe…7.2