PT-2021-16364 · WordPress · Tawk.To Live Chat

Name of the Vulnerable Software and Affected Versions: Tawk.To Live Chat WordPress plugin versions prior to 0.6.0 Description: The issue concerns the lack of capability and CSRF checks in the tawkto setwidget and tawkto removewidget AJAX actions, which are available to any authenticated user. Thi...

WordPress Tawk.To Live Chat plugin <= 0.5.5 - Visitor Monitoring & Chat Removal vulnerability

Visitor Monitoring & Chat Removal vulnerability discovered by Quentin VILLAIN 3wsec in WordPress Tawk.To Live Chat plugin versions = 0.5.5. Solution Update the WordPress Tawk.To Live Chat plugin to the latest available version at least 0.6.0...

Tawk.to Live Chat < 0.6.0 - Subscriber+ Visitor Monitoring & Chat Removal

The plugin does not have capability and CSRF checks in the tawktosetwidget and tawktoremovewidget AJAX actions, available to any authenticated user. The first one allows low-privileged users including simple subscribers to change the 'tawkto-embed-widget-page-id' and 'tawkto-embed-widget-widget-i...

tawk.to Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1169525 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

tawk.to Improper Access Control vulnerability

Open Bug Bounty ID: OBB-628560 Description| Value ---|--- Affected Website:| tawk.to Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Wordpress Vulnerability Type:| IAC Improper Access Control / CWE-284 CVSSv3 Score:| 6.5...