A reflected Cross‑Site Scripting flaw is present in Support Board 3.7.7. By placing malicious JavaScript in the 'search' parameter of '/supportboard/include/articles.php', an attacker can cause a victim’s browser to execute arbitrary code. This can lead to theft of session cookies, allowing account hijacking, or enable the attacker to perform actions on behalf of the user. The weakness is classified as CWE‑79.

The vulnerability affects the Schiocco Support Board application, specifically the 3.7.7 release. The vendor has released an update, version 3.7.8, that addresses the issue. The component is also distributed as a WordPress plugin; the fix applies to plugin installations as well.

The CVSS score of 4.8 indicates a moderate severity, while the EPSS score of less than 1% suggests a low current likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a malicious URL sent to a victim, exposing the risk primarily to web traffic. Although exploitation probability is low, successful exploitation could result in session hijacking or unauthorized actions, which is of significant concern.