Wp Live Chat Software For Wordpress Vulnerabilities

[en] Cross-Site Request Forgery (CSRF) vulnerability in LiveChat LiveChat – WP live chat plugin for WordPress.This issue affects LiveChat – WP live chat plugin for WordPress: from n/a through 4.5.15.

Affected:

up to 4.5.16

Fixed in:

4.5.16

Disclosed:

Dec 18, 2023

CVE-2023-49821 on NVD →

The LiveChat plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.5.15. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged request granted they ca...

CVSS:

4.3

Affected:

up to 4.5.15

Fixed in:

4.5.16

Disclosed:

Dec 5, 2023

CVE-2023-49821 on NVD →

Stored Cross-Site Scripting (XSS) and unauthenticated Option Update/Reset vulnerabilities found by Pluginvulnerabilities in WordPress LiveChat plugin (versions <= 3.7.2).

Affected:

up to 3.7.4

Fixed in:

3.7.4

Disclosed:

Jul 10, 2019

The WP LiveChat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'livechat_email' option in versions up to, and including, 3.7.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will ex...

CVSS:

6.4

Affected:

up to 3.7.3

Fixed in:

3.7.4

Disclosed:

Jun 26, 2019

The WP LiveChat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'livechat_email' option in versions up to, and including, 3.7.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will ex...

Affected:

up to 3.7.4

Fixed in:

3.7.4

Disclosed:

Jun 26, 2019

The lack of proper CSRF and Authorisation checks could allow an unauthenticated attacker to update or reset the plugin&#039;s settings. Furthermore, when updating the livechat_email option, no sanitisation is performed, leading to a Stored XSS issue in the plugin&#039;s settings page. CSRF and XSS fixed in 3.7.3, ho...

Affected:

up to 3.7.6

Fixed in:

3.7.6