CVE-2025-12448: Improper Neutralization of Input During Web Page Generation

The Smartsupp – live chat, AI shopping assistant and chatbots plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'code' parameter in all versions up to, and including, 3.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2020-37106: Cross-Site Request Forgery (CSRF)

Business Live Chat Software 1.0 contains a cross-site request forgery vulnerability that allows attackers to change user account roles without authentication. Attackers can craft a malicious HTML form to modify user privileges by submitting a POST request to the user creation endpoint with...

Bdtask Business Live Chat Software Cross-Site Request Forgery Vulnerability

Bdtask Business Live Chat Software is an online meeting software developed by the Bangladeshi company Bdtask. Version 1.0 of Bdtask Business Live Chat Software has a cross-site request forgeing vulnerability. This vulnerability arises because attackers may be able to change user account roles...

CVE-2016-10879

The wp-live-chat-support plugin before 6.2.02 for WordPress has XSS...

CVE-2019-18662

An issue was discovered in YouPHPTube through 7.7. User input passed through the livestreamcode POST parameter to /plugin/LiveChat/getChat.json.php is not properly sanitized in getFromChat in plugin/LiveChat/Objects/LiveChatObj.php before being used to construct a SQL query. This can be exploited...

CVE-2019-11185

The WP Live Chat Support Pro plugin through 8.0.26 for WordPress contains an arbitrary file upload vulnerability. This results from an incomplete patch for CVE-2018-12426. Arbitrary file upload is achieved by using a non-blacklisted executable file extension in conjunction with a whitelisted file...

CVE-2025-14154: Improper Neutralization of Input During Web Page Generation

The Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss plugin for WordPress is vulnerable to Stored Cross-Site Scripting via guest display name in all versions up to, and including, 2.10.2 due to insufficient input sanitization and output escaping. This make...

CVE-2025-12751

The WSChat – WordPress Live Chat plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'resetsettings' AJAX endpoint in all versions up to, and including, 3.1.6. This makes it possible for authenticated attackers, with Subscriber-level...

CVE-2025-12751

CVE-2025-12751 (WSChat – WordPress Live Chat) ?The Wordfence intelligence entry confirms a vulnerability in the WSChat WordPress Live Chat plugin (versions up to and including 3.1.6): a missing capability check on the reset_settings AJAX endpoint allows authenticated users with Subscriber-level a...

CVE-2025-12751: Missing Authorization

The WSChat – WordPress Live Chat plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'resetsettings' AJAX endpoint in all versions up to, and including, 3.1.6. This makes it possible for authenticated attackers, with Subscriber-level...

EUVD-2025-60970

The Five9 Live Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'toolbar' attribute of the five9-chat shortcode in all versions up to, and including, 1.1.2. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2025-11829

The Five9 Live Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'toolbar' attribute of the five9-chat shortcode in all versions up to, and including, 1.1.2. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2025-11829 Five9 Live Chat <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Five9 Live Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'toolbar' attribute of the five9-chat shortcode in all versions up to, and including, 1.1.2. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2025-11829

CVE-2025-11829 relates to the Five9 Live Chat plugin for WordPress. The WordPress plugin versions through 1.1.2 are vulnerable to Stored Cross-Site Scripting via the toolbar attribute in the [five9-chat] shortcode, due to insufficient input sanitization and output escaping. The Wordfence report (...

CVE-2025-11829 Five9 Live Chat <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Five9 Live Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'toolbar' attribute of the five9-chat shortcode in all versions up to, and including, 1.1.2. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

WordPress Five9 Live Chat plugin <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin Five9 Live Chat versions = 1.1.2...

CVE-2025-11829: Improper Neutralization of Input During Web Page Generation

The Five9 Live Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'toolbar' attribute of the five9-chat shortcode in all versions up to, and including, 1.1.2. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

PT-2025-46254

Name of the Vulnerable Software and Affected Versions Five9 Live Chat plugin for WordPress versions through 1.1.2 Description The Five9 Live Chat plugin for WordPress is susceptible to Stored Cross-Site Scripting through the toolbar attribute within the five9-chat shortcode. This occurs because o...

WordPress plugin Five9 Live Chat has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2025-11576: Improper Neutralization of Formula Elements in a CSV File

The AI Chatbot Free Models – Customer Support, Live Chat, Virtual Assistant plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 1.6.5. This is due to insufficient sanitization in the 'newcodebytechatbotexportmessages' function. This makes it possible for...