Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · supportboard
Support Board
9 known vulnerabilities on record. Add your version above to see which ones affect you.
Jun 17, 2026Unauthenticated Privilege Escalation in Support Board < 3.8.9 versions.CVE-2026-27395 · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in Support Board < 3.8.9 versions.
Dec 18, 2025Support Board: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-60182 · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Schiocco Support Board supportboard allows Reflected XSS.This issue affects Support Board: from n/a through < 3.8.7.
Aug 20, 2025Support Board: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-54031 · affects up to 3.8.0 · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Schiocco Support Board supportboard allows PHP Local File Inclusion.This issue affects Support Board: from n/a through <= 3.8.0.
Aug 20, 2025Support Board: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54027 · affects up to 3.8.0 · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Schiocco Support Board supportboard allows Reflected XSS.This issue affects Support Board: from n/a through <= 3.8.0.
Jul 8, 2025Support Board: Unauthorized access/modification/deletion of dataCVE-2025-4855 · affects up to 3.8.0 · reported by WordfenceCritical 9.8
The Support Board plugin for WordPress is vulnerable to unauthorized access/modification/deletion of data due to use of hardcoded default secrets in the sb_encryption() function in all versions up to, and including, 3.8.0. This makes it possible for unauthenticated attackers to bypass authorization and execute arbitrary AJAX actions defined in the sb_ajax_execute() function. An attacker can use this vulnerability to exploit CVE-2025-4828 and various other functions unauthenticated.
Jul 8, 2025Support Board: Arbitrary file deletionCVE-2025-4828 · affects up to 3.8.0 · reported by WordfenceCritical 9.8
The Support Board plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the sb_file_delete function in all versions up to, and including, 3.8.0. This makes it possible for attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). An attacker can leverage CVE-2025-4855 vulnerability to exploit this vulnerability unauthenticated.
Feb 28, 2022Support Board: Does not have any CSRF checks in actions handled by the include/ajaxCVE-2021-24823 · fixed in 3.3.6 · reported by WPScanHigh 8.1
The Support Board WordPress plugin before 3.3.6 does not have any CSRF checks in actions handled by the include/ajax.php file, which could allow attackers to make logged in users do unwanted actions. For example, make an admin delete arbitrary files
Nov 8, 2021Support Board: Allows Authenticated (Agent+) users to perform Cross-Site Scripting attacks by placing a payload in the notes fieldCVE-2021-24807 · fixed in 3.3.5 · reported by WPScanMedium 5.4
The Support Board WordPress plugin before 3.3.5 allows Authenticated (Agent+) users to perform Cross-Site Scripting attacks by placing a payload in the notes field, when an administrator or any authenticated user go to the chat the XSS will be automatically executed.
Sep 20, 2021Support Board: Does not escape multiple POST parameters (suchCVE-2021-24741 · fixed in 3.3.4 · reported by WPScanCritical 9.8
The Support Board WordPress plugin before 3.3.4 does not escape multiple POST parameters (such as status_code, department, user_id, conversation_id, conversation_status_code, and recipient_id) before using them in SQL statements, leading to SQL injections which are exploitable by unauthenticated users.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.