WordPress Plugin Vulnerabilities

WP Live Chat Support < 7.1.05 - Cross-Site Scripting (XSS)

Description

WP Live Chat Support is vulnerable by sending XSS payloads through chat.

Proof of Concept

Affects Plugins

Plugin icon
wp-live-chat-support
Fixed in 7.1.05

References

CVE
CVE-2017-18507
URL
https://plugins.trac.wordpress.org/changeset/1706931/wp-live-chat-support

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.1 (medium)

Miscellaneous

Submitter
Omaid Faizyar
Submitter website
https://medium.com/@omaidfaizyar
Verified
No
WPVDB ID
23043a51-ccf7-499c-90f9-44cee5812938

Timeline

Publicly Published
2017-07-30 (about 8 years ago)
Added
2017-08-07 (about 8 years ago)
Last Updated
2020-09-22 (about 5 years ago)

Other

Published
Title
Published
2023-04-24
Title
NS Coupon to Become Customer <= 1.2.2 - Admin+ Stored Cross-Site Scripting
Published
2026-03-06
Title
MailArchiver < 4.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings
Published
2022-07-05
Title
Advanced WordPress Reset < 1.6 - Reflected Cross-Site Scripting
Published
2026-01-16
Title
Team Section Block < 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Network Link
Published
2016-03-31
Title
WP External Links <= 1.80 - Multiple Cross-Site Scripting (XSS)