114 matches found
WordPress Live Chat Support Plugin < 8.0.26 Arbitrary File Upload Vulnerability
The WordPress plugin SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:3cx:livechat"; if description...
CVE-2022-2039 Free Live Chat Support <= 1.0.11 - Cross-Site Request Forgery to Cross-Site Scripting
The Free Live Chat Support plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.0.11. This is due to missing nonce protection on the livesupportisettings function found in the /livesupporti.php file. This makes it possible for unauthenticated attacke...
CVE-2022-2039
CVE-2022-2039 concerns the Free Live Chat Support plugin for WordPress, where a CSRF flaw stems from missing nonce protection in livesupporti_settings() (livesupporti.php). The affected range is up to and including 1.0.11 (some sources also reference 1.0.12). The vulnerability allows unauthentica...
PT-2022-14615 · WordPress · Free Live Chat Support
Name of the Vulnerable Software and Affected Versions: Free Live Chat Support plugin for WordPress versions up to, and including 1.0.11 Description: The issue is due to missing nonce protection on the livesupporti settings function found in the /livesupporti.php file. This allows unauthenticated...
WordPress Live Chat Support Plugin < 8.0.27 XSS Vulnerability
The WordPress plugin SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:3cx:livechat"; if description...
QIWI: [z.tochka.com] Unlimited file uploads lead to malware executed
Привет Нашел File Upload при загрузке изображения в чате поддержки банка Малварь загружается на z.tochka.com а значит он доверен 1. Заходим в чат 2. Загружаем малварь, можем его закриптовать, или просто загрузить .bat файл который будет выполнять какие либо действия на устройствах сотрудников 3...
WordPress Unauthorized Access Vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WP Live Chat Support is a live chat plugin used in it. A security vulnerability exists in WordPress WP Live Chat Support versions prior...
CVE-2019-12498
The WP Live Chat Support plugin before 8.0.33 for WordPress accepts certain REST API calls without invoking the wplcapipermissioncheck protection mechanism...
CVE-2019-12498
The WP Live Chat Support plugin before 8.0.33 for WordPress accepts certain REST API calls without invoking the wplcapipermissioncheck protection mechanism...
CVE-2019-12498
The CVE-2019-12498 entry affects the WordPress WP Live Chat Support plugin, where versions prior to 8.0.33 allow unauthenticated REST API access because the wplc_api_permission_check protection is not invoked. Public sources (NVD, Red Hat, CVE lists) describe this as an API-authentication bypass ...
CVE-2019-12498
The WP Live Chat Support plugin before 8.0.33 for WordPress accepts certain REST API calls without invoking the wplcapipermissioncheck protection mechanism...
Design/Logic Flaw
The wp-live-chat-support plugin before 4.1.0 for WordPress has JavaScript injections...
CVE-2014-10386
The vulnerability CVE-2014-10386 affects the WordPress wp-live-chat-support plugin prior to version 4.1.0 and involves JavaScript injections. Affected software: wp-live-chat-support plugin for WordPress. Root cause: improper handling of input allowing injection of JavaScript into the plugin’s con...
PT-2019-7062 · WordPress · Wp-Live-Chat-Support
Name of the Vulnerable Software and Affected Versions: wp-live-chat-support plugin versions prior to 4.1.0 Description: The issue concerns JavaScript injections in the wp-live-chat-support plugin for WordPress. Recommendations: For versions prior to 4.1.0, update to version 4.1.0 or later to...
CVE-2017-18507
The wp-live-chat-support plugin before 7.1.05 for WordPress has XSS...
Cross site scripting
The wp-live-chat-support plugin before 7.1.05 for WordPress has XSS...
CVE-2017-18507
CVE-2017-18507 affects the WordPress plugin "wp-live-chat-support" prior to version 7.1.05. The vulnerability is described as a cross-site scripting (XSS) issue in the plugin, allowing an attacker to execute client-side code. The root cause is not explicitly detailed in the provided documents bey...
PT-2019-8442 · WordPress · Wp-Live-Chat-Support
Name of the Vulnerable Software and Affected Versions: wp-live-chat-support plugin versions prior to 7.1.05 Description: The issue affects the wp-live-chat-support plugin, allowing for cross-site scripting XSS attacks. Recommendations: For versions prior to 7.1.05, update to version 7.1.05 or lat...