plugin

Tawkto Live Chat Vulnerabilities

1 known security issue reported for the Tawkto Live Chat WordPress plugin. Most recent disclosed Nov 8, 2021.

1 high

Running Tawkto Live Chat on your site? Check whether your installed version is affected.

Tawk.To Live Chat <= 0.5.4 - Missing Authorization to Visitor Monitoring & Chat Removal

high

The Tawk.To Live Chat WordPress plugin before 0.6.0 does not have capability and CSRF checks in the tawkto_setwidget and tawkto_removewidget AJAX actions, available to any authenticated user. The first one allows low-privileged users (including simple subscribers) to change the 'tawkto-embed-widget-page-id' and 'tawkto...

CVSS:: 8
Affected:: up to 0.6.0
Fixed in:: 0.6.0
Disclosed:: Nov 8, 2021

CVE-2021-24914 on NVD →

Protect your WordPress site

Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.

Scan your site free

← Back to the vulnerability database