title: Support Board < 3.3.5 - Agent+ Stored Cross-Site Scripting
description: The Support Board WordPress plugin before 3.3.5 allows Authenticated (Agent+) users to perform Cross-Site Scripting attacks by placing a payload in the notes field, when an administrator or any authenticated user go to the chat the XSS will be automatically executed.
problem types: CWE-79 Cross-site Scripting (XSS)
affected:
{
product: Support Board
vendor: Unknown
versions:
lessThan: 3.3.5, status: affected, version: 3.3.5, versionType: custom
}