CVE-2021-24807

The Support Board WordPress plugin before 3.3.5 allows Authenticated (Agent+) users to perform Cross-Site Scripting attacks by placing a payload in the notes field, when an administrator or any authenticated user go to the chat the XSS will be automatically executed.

• CWE-79
• CWE-79

• https://github.com/itsjeffersonli/CVE-2021-24807Exploit, Third Party Advisory
• https://medium.com/%40lijohnjefferson/cve-2021-24807-6bc22af2a444
• https://wpscan.com/vulnerability/19d101aa-4b60-4db4-a33b-86c826b288b0Exploit, Third Party Advisory
• https://github.com/itsjeffersonli/CVE-2021-24807Exploit, Third Party Advisory
• https://medium.com/%40lijohnjefferson/cve-2021-24807-6bc22af2a444
• https://wpscan.com/vulnerability/19d101aa-4b60-4db4-a33b-86c826b288b0Exploit, Third Party Advisory

Published

Nov 8, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-24801The WP Survey Plus WordPress plugin through 1.0 does not hav…4.3
• CVE-2021-24802The Colorful Categories WordPress plugin before 2.0.15 does …6.5
• CVE-2021-24803The Core Tweaks WP Setup WordPress plugin through 4.1 allows…8.8
• CVE-2021-24804The Simple JWT Login WordPress plugin before 3.2.1 does not …8.8
• CVE-2021-24805The DW Question & Answer Pro WordPress plugin through 1.3.4 …4.3
• CVE-2021-24806The wpDiscuz WordPress plugin before 7.3.4 does check for CS…4.3
• CVE-2021-24808The BP Better Messages WordPress plugin before 1.9.9.41 sani…6.1
• CVE-2021-24809The BP Better Messages WordPress plugin before 1.9.9.41 does…8.8
• CVE-2021-2481Vulnerability in the MySQL Server product of Oracle MySQL (c…6.5
• CVE-2021-24810The WP Event Manager WordPress plugin before 3.1.23 does not…4.8
• CVE-2021-24811The Shop Page WP WordPress plugin before 1.2.8 does not sani…4.8
• CVE-2021-24812The BetterLinks WordPress plugin before 1.2.6 does not sanit…5.4