CVE-2018-11105

🗓️ 15 May 2018 15:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov👁 63 Views🌐 WEB

Stored cross site scripting in wp-live-chat-support plugin before 8.0.08 for WordPress via "name" and "email" input fields to wp-json/wp_live_chat_support/v1/start_chat when a malicious attacker initiates chat with an administrator. NOTE: incomplete fix for CVE-2018-9864

Reporter	Title	Published	Views	Family All 9
CNVD	WordPress wp-live-chat-support plugin cross-site scripting vulnerability	17 May 201800:00	–	cnvd
Cvelist	CVE-2018-11105	15 May 201815:00	–	cvelist
EUVD	EUVD-2018-3147	7 Oct 202500:30	–	euvd
NVD	CVE-2018-11105	15 May 201815:29	–	nvd
OSV	CVE-2018-11105	15 May 201815:29	–	osv
Patchstack	WordPress WP Live Chat Support plugin <=8.0.07 - Authenticated Cross-Site Scripting (XSS) vulnerability	17 May 201800:00	–	patchstack
Prion	Cross site scripting	15 May 201815:29	–	prion
Positive Technologies	PT-2018-10311 · WordPress · Wp-Live-Chat-Support	15 May 201800:00	–	ptsecurity
WPVulnDB	WP Live Chat Support < 8.0.08 - Cross-Site Scripting (XSS)	15 May 201800:00	–	wpvulndb

NVD

Node

3cx live_chatRange<8.0.08wordpress

Source	Link
wordpress	www.wordpress.org/plugins/wp-live-chat-support/
github	www.github.com/RiieCco/write-ups/tree/master/CVE-2018-11105

Parameter	Position	Path	Description	CWE
name	request body	wp-json/wp_live_chat_support/v1/start_chat	Stored XSS via name/email fields in the start_chat endpoint.	CWE-79
email	request body	wp-json/wp_live_chat_support/v1/start_chat	Stored XSS via name/email fields in the start_chat endpoint.	CWE-79

17 Jun 2026 01:35Current

6.1Medium risk

Vulners AI Score6.1

CVSS 24.3

CVSS 36.1

EPSS0.01098

CWE-79