WordPress Plugin Vulnerabilities

Chaty < 3.1 - Admin+ Stored Cross-Site Scripting

Description

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Affects Plugins

Plugin icon
chaty
Fixed in 3.1

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
3.5 (low)

Miscellaneous

Verified
No
WPVDB ID
afcf75d8-4e72-41f1-8ae5-9262c3ecc5a3

Timeline

Publicly Published
2023-05-16 (about 3 years ago)
Added
2023-08-30 (about 2 years ago)
Last Updated
2023-08-30 (about 2 years ago)

Other

Published
Title
Published
2020-04-22
Title
Catch Breadcrumb < 1.5.7 - Unauthenticated Reflected XSS
Published
2025-05-19
Title
Newsletter < 8.8.5 - Admin+ Stored XSS via Widget
Published
2022-07-04
Title
Popup Anything < 2.1.7 - Reflected Cross-Site Scripting
Published
2025-05-20
Title
Raisely Donation Form < 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via raisely_donation_form Shortcode
Published
2025-01-07
Title
Scanventory <= 1.1.3 - Reflected Cross-Site Scripting