WordPress Plugin Vulnerabilities

Crisp Live Chat < 0.32 - CSRF to Stored Cross-Site Scripting

Description

The plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation via the crisp_plugin_settings_page function found in the ~/crisp.php file, which made it possible for attackers to inject arbitrary web scripts in versions up to, and including 0.31.

Affects Plugins

Plugin icon
crisp
Fixed in 0.32

References

CVE
CVE-2021-43353
URL
https://www.wordfence.com/vulnerability-advisories/#CVE-2021-43353

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
7.5 (high)

Miscellaneous

Original Researcher
José Aguilera
Verified
Yes
WPVDB ID
09383587-8251-4955-a48a-70ae0bdc228e

Timeline

Publicly Published
2021-12-16 (about 4 years ago)
Added
2021-12-17 (about 4 years ago)
Last Updated
2022-04-16 (about 4 years ago)

Other

Published
Title
Published
2025-04-01
Title
Feedbucket < 1.0.7 - Cross-Site Request Forgery
Published
2024-08-01
Title
Tutor LMS < 2.7.3 - Cross-Site Request Forgery
Published
2023-11-28
Title
Prevent Landscape Rotation < 2.1 - Settings Update via CSRF
Published
2025-01-27
Title
MailUp Auto Subscription < 1.2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published
2025-03-13
Title
InstaWP Connect – 1-click WP Staging & Migration < 0.1.0.84 - Cross-Site Request Forgery to Local File Inclusion