CVE-2021-24741: Schiocco Support Board - Chat And Help Desk

Critical severity, CVSS 9.8. EPSS: 5.6% chance of exploitation in the next 30 days.

The Support Board WordPress plugin before 3.3.4 does not escape multiple POST parameters (such as status_code, department, user_id, conversation_id, conversation_status_code, and recipient_id) before using them in SQL statements, leading to SQL injections which are exploitable by unauthenticated users.

Affected products

• Schiocco Support Board - Chat And Help Desk: before 3.3.4 (fixed in 3.3.4)

Published 2021-09-20. Last modified 2026-06-17.