The vulnerability is an improper neutralization of input during web page generation that allows malicious JavaScript to be reflected back to users who view a page that includes the plugin’s input fields. An attacker can embed a crafted URL or form payload that contains executable script; when an authenticated or unauthenticated visitor opens the page, the script runs in the victim’s browser. The impact is client‑side code execution which can lead to session hijacking, credential theft, or delivery of phishing content, thereby compromising confidentiality and integrity of the user session.

Schiocco Support Board plugin, versions prior to 3.8.7 (any release starting from the first available version up to 3.8.6).

The CVSS score of 7.1 classifies this as high severity. The EPSS score of less than 1% indicates that, while exploitation is possible, the likelihood of widespread attacks is currently low. The vendor does not list this issue in the CISA KEV catalog. Attack requires a user to visit a crafted URL or interact with a form that the plugin processes, after which the attacker’s script is executed in the victim’s browser. No additional privileges or network connectivity are necessary beyond the target web application.