Rumbletalk Chat A Chat With Themes Vulnerabilities

The RumbleTalk Live Group Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 6.3.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web script...

CVSS:

6.4

Affected:

up to 6.3.5

Fixed in:

6.3.6

Disclosed:

Sep 3, 2025

CVE-2025-58626 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RumbleTalk RumbleTalk Live Group Chat allows Stored XSS. This issue affects RumbleTalk Live Group Chat: from n/a through 6.3.5.

Affected:

up to 6.3.6

Fixed in:

6.3.6

Disclosed:

Sep 3, 2025

CVE-2025-58626 on NVD →

[en] Missing Authorization vulnerability in RumbleTalk Ltd RumbleTalk Live Group Chat allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RumbleTalk Live Group Chat: from n/a through 6.2.5.

Affected:

up to 6.2.0

Fixed in:

6.2.0

Disclosed:

Jan 2, 2025

CVE-2023-45828 on NVD →

[en] The RumbleTalk Live Group Chat – HTML5 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'rumbletalk-admin-button' shortcode in all versions up to, and including, 6.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible fo...

Affected:

up to 6.3.1

Fixed in:

6.3.1

Disclosed:

Oct 1, 2024

CVE-2024-8720 on NVD →

The RumbleTalk Live Group Chat – HTML5 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'rumbletalk-admin-button' shortcode in all versions up to, and including, 6.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for aut...

CVSS:

6.4

Affected:

up to 6.3.0

Fixed in:

6.3.1

Disclosed:

Sep 30, 2024

CVE-2024-8720 on NVD →

The RumbleTalk Live Group Chat plugin for WordPress is vulnerable to unauthorized access of data, modification of data, and loss of data due to a missing capability check on the handleRequest AJAX function in versions up to, and including, 6.1.9. This makes it possible for authenticated attackers, with subscriber-level...

CVSS:

7.6

Affected:

up to 6.1.9

Fixed in:

6.2.0

Disclosed:

Oct 13, 2023

CVE-2023-45828 on NVD →