Chat Bubble Vulnerabilities

[en] The Chat Bubble – Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.3 due to insufficient input sanitization and output escaping. This makes it possible for...

Affected:

up to 2.3

Fix:

No patched version reported

Disclosed:

Mar 13, 2024

CVE-2024-0898 on NVD →

The Chat Bubble – Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.3 due to insufficient input sanitization and output escaping. This makes it possible for auth...

CVSS:

4.4

Affected:

up to 2.3

Fix:

No patched version reported

Disclosed:

Feb 27, 2024

CVE-2024-0898 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in Blue Coral Chat Bubble – Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back.This issue affects Chat Bubble – Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back: from n/a through 2.3.

Affected:

up to 2.3

Fix:

No patched version reported

Disclosed:

Dec 18, 2023

CVE-2023-48769 on NVD →

The Chat Bubble plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3. This is due to missing or incorrect nonce validation on the cbb_submit_settings_data function. This makes it possible for unauthenticated attackers to modify the plugin's settings via a forged request...

CVSS:

6.5

Affected:

up to 2.3

Fix:

No patched version reported

Disclosed:

Nov 28, 2023

CVE-2023-48769 on NVD →

[en] The Chat Bubble WordPress plugin before 2.3 does not sanitise and escape some contact parameters, which could allow unauthenticated attackers to set Stored Cross-Site Scripting payloads in them, which will trigger when an admin view the related contact message

Affected:

up to 2.3

Fixed in:

2.3

Disclosed:

Nov 14, 2022

CVE-2022-3415 on NVD →

The Chat Bubble plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an...

CVSS:

7.2

Affected:

up to 2.2

Fixed in:

2.3

Disclosed:

Oct 18, 2022

CVE-2022-3415 on NVD →