114 matches found
CVE-2018-18460
XSS exists in the wp-live-chat-support v8.0.15 plugin for WordPress via the modules/gdpr.php term parameter in a wp-admin/admin.php wplivechat-menu-gdpr-page request...
Design/Logic Flaw
XSS exists in the wp-live-chat-support v8.0.15 plugin for WordPress via the modules/gdpr.php term parameter in a wp-admin/admin.php wplivechat-menu-gdpr-page request...
CVE-2018-18460
CVE-2018-18460 affects the WordPress plugin wp-live-chat-support version 8.0.15 . The vulnerability is a Cross-Site Scripting (XSS) flaw in the file modules/gdpr.php that can be triggered via the parameter term in requests to the admin endpoint /wp-admin/admin.php on the page wplivechat-menu-gdpr...
WordPress WP Live Chat Support Pro Remote Code Execution Vulnerability
WordPress is a blogging platform developed by the WordPress Software Foundation using the PHP language, which supports setting up personal blog sites on PHP and MySQL servers.WP Live Chat Support Pro is a web chat plugin used in it. A remote code execution vulnerability exists in WordPress WP Liv...
CVE-2018-12426
The CVE-2018-12426 entry concerns the WP Live Chat Support Pro WordPress plugin prior to version 8.0.07, vulnerable to unauthenticated remote code execution via crafted file uploads. Root cause per connected docs: the plugin validates file types on the client side and uses MIME checks that can be...
CVE-2018-11105
There is stored cross site scripting in the wp-live-chat-support plugin before 8.0.08 for WordPress via the "name" aka wplcname and "email" aka wplcemail input fields to wp-json/wplivechatsupport/v1/startchat whenever a malicious attacker would initiate a new chat with an administrator. NOTE: thi...
CVE-2018-11105
There is stored cross site scripting in the wp-live-chat-support plugin before 8.0.08 for WordPress via the "name" aka wplcname and "email" aka wplcemail input fields to wp-json/wplivechatsupport/v1/startchat whenever a malicious attacker would initiate a new chat with an administrator. NOTE: thi...
CVE-2018-11105
CVE-2018-11105 describes a stored cross-site scripting (XSS) vulnerability in the WordPress WP Live Chat Support plugin for versions prior to 8.0.08. The flaw allows injection via the name (wplc_name) and email (wplc_email) fields to the API endpoint /wp-json/wp_live_chat_support/v1/start_chat wh...
WP Live Chat Support Cross-Site Scripting Vulnerability
WordPress is a blogging platform developed by the WordPress Software Foundation using the PHP language, which supports setting up personal blog sites on servers running PHP and MySQL.WP Live Chat Support is one of the components that supports live chat. A cross-site scripting vulnerability exists...
CVE-2018-9864
The WP Live Chat Support plugin before 8.0.06 for WordPress has stored XSS via the Name field...
Cross site scripting
The WP Live Chat Support plugin before 8.0.06 for WordPress has stored XSS via the Name field...
CVE-2018-9864
The WP Live Chat Support plugin before 8.0.06 for WordPress has stored XSS via the Name field...
CVE-2018-9864
CVE-2018-9864 affects the WP Live Chat Support plugin for WordPress (older than 8.0.06). The vulnerability is a stored XSS in the Name field (wplc_name) that could be triggered via wp_json/wp_live_chat_support/v1/start_chat when initiating a chat. Public records show CVSS2 base 4.3 (MEDIUM) and C...
WordPress WP Live Chat Support plugin <=8.0.05 - Unauthenticated Stored XSS vulnerability
Unauthenticated Stored XSS vulnerability found by Luigi in WordPress WP Live Chat Support plugin versions =8.0.05. Solution Update the WordPress WP Live Chat Support plugin to the latest available version at least 8.0.06...
WP Live Chat Support < 8.0.06 - Unauthenticated Stored XSS
An unauthenticated user can inject arbitrary javascript code in the admin panel by using the text field "Name" of WP Live Chat Support. The arbitrary code runs on the page wplivechat-menu-history. In the file wp-live-chat-support.php there is no sanitization of $result-id row 4439. WP Live Chat...
WP Live Chat Support 8.0.05 Cross Site Scripting
An unauthenticated user can inject arbitrary javascript code in the admin panel by using the text field aNamea of WP Live Chat Support. The arbitrary code runs on the page wplivechat-menu-history. In the file wp-live-chat-support.php there is no sanitization of $result-id row 4439. WP Live Chat...
WordPress WP Live Chat Support Plugin < 7.0.07 XSS Vulnerability
The WordPress plugin SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:3cx:livechat"; if description...
WordPress WP Live Chat Support plugin <=7.1.04 - Cross-Site Scripting (XSS) vulnerability
Cross-Site Scripting XSS vulnerability discovered by Omaid Faizyar in WordPress WP Live Chat Support plugin version 7.1.0.4 and earlier versions. The vulnerability allows an attacker to send Cross-Site Scripting XSS payloads by chat. Solution Update the WordPress WP Live Chat Support plugin to th...