WordPress Plugin Vulnerabilities
WP Live Chat Support < 8.0.06 - Unauthenticated Stored XSS
Description
An unauthenticated user can inject arbitrary javascript code in the admin panel by using the text field "Name" of WP Live Chat Support. The arbitrary code runs on the page wplivechat-menu-history.
In the file wp-live-chat-support.php there is no sanitization of $result->id (row 4439).
WP Live Chat Support 8.0.05 is vulnerable, probably earlier versions too.
The vulnerability is fixed in WP Live Cjat Support 8.0.06
Affects Plugins
Fixed in 8.0.06 References
Classification
Type
XSS
OWASP top 10
CWE
CVSS
Miscellaneous
Submitter
Luigi
Submitter website
Verified
No
WPVDB ID
Timeline
Publicly Published
2018-04-09 (about 8 years ago)
Added
2018-04-09 (about 8 years ago)
Last Updated
2021-01-19 (about 5 years ago)
WPScan 