Skip to content
OpenAdvisories

Vendor

Schiocco

8 known vulnerabilities.

Schiocco at a glance

Last 12 months
4
Critical · all time
3
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 1 2 December 2025: 1 vulnerability Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 2 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 1 vulnerability, 1 critical Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202600
Jul 202600
Jun 202611
May 202600
Apr 202600
Mar 202620
Feb 202600
Jan 202600
Dec 202510
Nov 202500
Oct 202500
Sep 202500
Aug 202520
Jul 202522
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

Support Board 8
All Critical High Medium Low Exploited only Public exploit

8 results · Feed

  • Critical 9.8
    CVE-2026-27395

    WordPress Support Board plugin < 3.8.9 - Privilege Escalation vulnerability

    Unauthenticated Privilege Escalation in Support Board < 3.8.9 versions.

    Schiocco Support Board
  • High 8.7
    CVE-2026-4815

    SQL Injection vulnerability in Support Board

    A SQL Injection vulnerability has been found in Support Board v3.7.7. This vulnerability allows an attacker to retrieve, create, update and delete database via 'calls[0][message_ids][]' parameter in '/supportboard/include/ajax.php' endpoint.

    Schiocco Support Board
  • Medium 4.8
    CVE-2026-4816

    Reflected Cross Site Scripting (XSS) vulnerability in Support Board

    A Reflected Cross Site Scripting (XSS) vulnerability has been found in Support Board v3.7.7. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL using the 'search' parameter in '/suppo…

    Schiocco Support Board
  • High 7.1
    CVE-2025-60182

    WordPress Support Board plugin < 3.8.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Schiocco Support Board supportboard allows Reflected XSS.This issue affects Support Board: from n/a through < 3.8.7.

    Schiocco Support Board
  • High 7.1
    CVE-2025-54027

    WordPress Support Board <= 3.8.0 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Schiocco Support Board supportboard allows Reflected XSS.This issue affects Support Board: from n/a through <= 3.8.0.

    Schiocco Support Board
  • High 8.1
    CVE-2025-54031

    WordPress Support Board <= 3.8.0 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Schiocco Support Board supportboard allows PHP Local File Inclusion.This issue affects Support Board: from n/a through <= 3.8.0.

    Schiocco Support Board
  • Critical 9.8
    CVE-2025-4828

    Support Board <= 3.8.0 - Unauthenticated Arbitrary File Deletion

    The Support Board plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the sb_file_delete function in all versions up to, and including, 3.8.0. This makes it possible for attackers to delete arbitrary files…

    Schiocco Support Board Web / CMS
  • Critical 9.8
    CVE-2025-4855

    Support Board <= 3.8.0 - Unauthenticated Authorization Bypass due to Use of Default Secret Key

    The Support Board plugin for WordPress is vulnerable to unauthorized access/modification/deletion of data due to use of hardcoded default secrets in the sb_encryption() function in all versions up to, and including, 3.8.0. This makes it possible for unauthent…

    Schiocco Support Board Web / CMS