Chat Security Vulnerabilities

CVE-2022-0148

The All-in-one Floating Contact Form, Call, Chat, and 50+ Social Icon Tabs WordPress plugin before 2.0.4 was vulnerable to reflected XSS on the my-sticky-elements-leads admin...

CVE-2022-0502

Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to...

CVE-2022-0395

Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to...

CVE-2022-0394

Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to...

CVE-2022-0375

Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to...

CVE-2022-0374

Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to...

CVE-2022-0266

Authorization Bypass Through User-Controlled Key in Packagist remdex/livehelperchat prior to...

CVE-2021-43353

The Crisp Live Chat WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation via the crisp_plugin_settings_page function found in the ~/crisp.php file, which made it possible for attackers to inject arbitrary web scripts in versions up to, and including...

CVE-2022-0226

livehelperchat is vulnerable to Cross-Site Request Forgery...

CVE-2022-0231

livehelperchat is vulnerable to Cross-Site Request Forgery...

CVE-2022-0083

livehelperchat is vulnerable to Generation of Error Message Containing Sensitive...

CVE-2021-25016

The Chaty WordPress plugin before 2.8.3 and Chaty Pro WordPress plugin before 2.8.2 do not sanitise and escape the search parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site...

CVE-2021-4176

livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site...

CVE-2021-4175

livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site...

CVE-2021-4179

livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site...

CVE-2021-4177

livehelperchat is vulnerable to Generation of Error Message Containing Sensitive...

CVE-2021-24992

The Smart Floating / Sticky Buttons WordPress plugin before 2.5.5 does not sanitise and escape some parameter before outputting them in attributes and page, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is...

CVE-2021-4169

livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site...

CVE-2021-4131

livehelperchat is vulnerable to Cross-Site Request Forgery...

CVE-2021-4132

livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site...

CVE-2021-4123

livehelperchat is vulnerable to Cross-Site Request Forgery...

CVE-2021-44228

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message....

CVE-2021-4050

livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site...

CVE-2021-4049

livehelperchat is vulnerable to Cross-Site Request Forgery...

CVE-2021-24914

The Tawk.To Live Chat WordPress plugin before 0.6.0 does not have capability and CSRF checks in the tawkto_setwidget and tawkto_removewidget AJAX actions, available to any authenticated user. The first one allows low-privileged users (including simple subscribers) to change the...

CVE-2021-24741

The Support Board WordPress plugin before 3.3.4 does not escape multiple POST parameters (such as status_code, department, user_id, conversation_id, conversation_status_code, and recipient_id) before using them in SQL statements, leading to SQL injections which are exploitable by unauthenticated...

CVE-2021-38332

The On Page SEO + Whatsapp Chat Button Plugin WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/settings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including...

CVE-2021-34656

The 2Way VideoCalls and Random Chat - HTML5 Webcam Videochat WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the vws_notice function found in the ~/inc/requirements.php file which allows attackers to inject arbitrary web scripts, in versions up to and including...

CVE-2020-15948

eGain Chat 15.5.5 allows XSS via the Name (aka full_name)...

CVE-2021-24343

The iFlyChat WordPress plugin before 4.7.0 does not sanitise its APP ID setting before outputting it back in the page, leading to an authenticated Stored Cross-Site Scripting...

CVE-2021-30480

Zoom Chat through 2021-04-09 on Windows and macOS allows certain remote authenticated attackers to execute arbitrary code without user interaction. An attacker must be within the same organization, or an external party who has been accepted as a contact. NOTE: this is specific to the Zoom Chat...

CVE-2020-5642

Cross-site request forgery (CSRF) vulnerability in Live Chat - Live support version 3.1.0 and earlier allows remote attackers to hijack the authentication of administrators via unspecified...

CVE-2020-26135

Live Helper Chat before 3.44v allows reflected XSS via the setsettingajax...

CVE-2020-26134

Live Helper Chat before 3.44v allows stored XSS in chat messages with an operator via...

CVE-2020-13972

Enghouse Web Chat 6.2.284.34 allows XSS. When one enters their own domain name in the WebServiceLocation parameter, the response from the POST request is displayed, and any JavaScript returned from the external server is executed in the browser. This is related to...

CVE-2019-12498

The WP Live Chat Support plugin before 8.0.33 for WordPress accepts certain REST API calls without invoking the wplc_api_permission_check protection...

CVE-2019-20502

An issue was discovered in EFS Easy Chat Server 3.1. There is a buffer overflow via a long body2.ghp message...

CVE-2019-16950

An XSS issue was discovered in Enghouse Web Chat 6.1.300.31 and 6.2.284.34. The QueueName parameter of a GET request allows for insertion of user-supplied...

CVE-2019-16951

A remote file include (RFI) issue was discovered in Enghouse Web Chat 6.2.284.34. One can replace the localhost attribute with one's own domain name. When the product calls this domain after the POST request is sent, it retrieves an attacker's data and displays it. Also worth mentioning is the...

CVE-2019-16949

An issue was discovered in Enghouse Web Chat 6.1.300.31 and 6.2.284.34. A user is allowed to send an archive of their chat log to an email address specified at the beginning of the chat (where the user enters in their name and e-mail address). This POST request can be modified to change the...

CVE-2019-16948

An SSRF issue was discovered in Enghouse Web Chat 6.1.300.31. In any POST request, one can replace the port number at WebServiceLocation=http://localhost:8085/UCWebServices/ with a range of ports to determine what is visible on the internal network (as opposed to what general web traffic would see....

CVE-2019-14367

Slack-Chat through 1.5.5 leaks a Slack Access Token in source code. An attacker can obtain a lot of information about the victim's Slack (channels, members,...

CVE-2019-1877

A vulnerability in the HTTP API of Cisco Enterprise Chat and Email could allow an unauthenticated, remote attacker to download files attached through chat sessions. The vulnerability is due to insufficient authentication mechanisms on the file download function of the API. An attacker could...

CVE-2019-17176

Genesys PureEngage Digital (eServices) 8.1.x allows XSS via HtmlChatPanel.jsp or HtmlChatFrameSet.jsp (ActionColor, ClientNickNameColor, Email, email, or email_address...

CVE-2019-11668

HTTP cookie in Micro Focus Service manager, Versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62. And Micro Focus Service Manager Chat Server, versions 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62. And Micro Focus Service Manager Chat Service 9.41, 9.50, 9.51,...

CVE-2019-13976

eGain Chat 15.0.3 allows unrestricted file...

CVE-2019-13975

eGain Chat 15.0.3 allows HTML...

CVE-2014-10386

The wp-live-chat-support plugin before 4.1.0 for WordPress has JavaScript...

CVE-2017-18507

The wp-live-chat-support plugin before 7.1.05 for WordPress has...

CVE-2019-14950

The wp-live-chat-support plugin before 8.0.27 for WordPress has XSS via the GDPR...