Smart Shoutbox by thekrotek.com, version 2.9.5 and previous, SQL Injection
resolution: update to 3.0.0, (version released July 2017)
update notice: so far the developer has not made an update notice making clear that this was a security release
The developer says "Version 3.0 is an absolutely new release, I reworked it completely, and this issue has gone by itself."
.