WordPress Plugin Vulnerabilities

Chat Button < 1.8.10 - Admin+ Stored XSS

Description

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Affects Plugins

Plugin icon
whatshelp-chat-button
Fixed in 1.8.10

References

CVE
CVE-2023-32292

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
3.5 (low)

Miscellaneous

Original Researcher
Jayasuryapal G
Verified
No
WPVDB ID
2a4dddac-634f-49d2-9042-79cf5a7945da

Timeline

Publicly Published
2023-07-17 (about 2 years ago)
Added
2023-08-09 (about 2 years ago)
Last Updated
2023-08-09 (about 2 years ago)

Other

Published
Title
Published
2020-03-26
Title
IMPress for IDX Broker < 2.6.2 - Authenticated Stored Cross-Site Scripting (XSS) via unprotected 'idx_update_recaptcha_key' AJAX
Published
2024-01-19
Title
Chart.js for WordPress <= 2023.2 - Editor+ Stored Cross-Site Scripting
Published
2025-01-14
Title
WP Dream Carousel <= 1.0.1b - Reflected XSS
Published
2022-02-22
Title
Header Footer Code Manager < 1.1.17 - Reflected Cross-Site Scripting
Published
2024-03-15
Title
GiveWP < 3.4.0 - Reflected Cross-Site Scripting