Crisp Vulnerabilities

The Crisp plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 0.44 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will ex...

CVSS:

6.4

Affected:

up to 0.44

Fixed in:

0.45

Disclosed:

Mar 13, 2024

CVE-2024-27963 on NVD →

The Crisp Live Chat WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation via the crisp_plugin_settings_page function found in the ~/crisp.php file, which made it possible for attackers to inject arbitrary web scripts in versions up to, and including 0.31.

CVSS:

8.8

Affected:

up to 0.31

Fixed in:

0.32

Disclosed:

Dec 16, 2021

CVE-2021-43353 on NVD →