WordPress Plugin Vulnerabilities

LiveChat < 4.5.16 - Cross-Site Request Forgery

Description

The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks

Affects Plugins

Plugin icon
wp-live-chat-software-for-wordpress
Fixed in 4.5.16

References

CVE
CVE-2023-49821
URL
https://patchstack.com/database/vulnerability/wp-live-chat-software-for-wordpress/wordpress-livechat-plugin-4-5-15-cross-site-request-forgery-csrf-vulnerability

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Brandon James Roldan (tomorrowisnew)
Verified
No
WPVDB ID
5c3cead2-4267-4409-9f80-304898b261d8

Timeline

Publicly Published
2023-12-05 (about 2 years ago)
Added
2023-12-09 (about 2 years ago)
Last Updated
2023-12-15 (about 2 years ago)

Other

Published
Title
Published
2025-04-09
Title
Custom Posts Order <= 4.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published
2024-05-27
Title
Integration for Contact Form 7 and Constant Contact < 1.1.6 - CSRF
Published
2024-01-02
Title
PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) < 2.7.14 - Settings Reset/Update via CSRF
Published
2024-01-16
Title
Better Anchor Links <= 1.7.5 - Cross-Site Request Forgery via admin/options.php
Published
2022-09-23
Title
Kraken.io Image Optimizer < 2.6.6 - Settings Update via CSRF