WordPress Plugin Vulnerabilities

Pure Chat – Live Chat & More! < 2.41 - Reflected Cross-Site Scripting via purechatWidgetName Parameter

Description

The Pure Chat – Live Chat & More! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘purechatWidgetName’ parameter in all versions up to, and including, 2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affects Plugins

Plugin icon
pure-chat
Fixed in 2.41

References

CVE
CVE-2024-13736
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/e11993c1-48fa-4e37-850d-d02e3e20d56f

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.1 (medium)

Miscellaneous

Original Researcher
Rein Daelman (trein)
Verified
No
WPVDB ID
69919f5e-8ffc-4856-94a2-f4f2fea51cfd

Timeline

Publicly Published
2025-02-18 (about 1 year ago)
Added
2025-02-18 (about 1 year ago)
Last Updated
2025-02-28 (about 1 year ago)

Other

Published
Title
Published
2023-11-30
Title
Quiz Maker < 6.4.9.5 - Reflected Cross-Site Scripting
Published
2025-08-14
Title
Plugin README Parser <= 1.3.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via target Parameter
Published
2025-02-03
Title
Dynamic URL SEO < 1.2 - Reflected Cross-Site Scripting
Published
2025-10-26
Title
Easy Social Share Buttons < 10.7.1 - Unauthenticated Stored Cross-Site Scripting
Published
2021-01-12
Title
Orbit Fox by ThemeIsle < 2.10.3 - Authenticated Stored Cross Site Scripting