CVE-2021-24343

Vulnerability summary (CVE-2021-24343) : The WordPress iFlyChat – WordPress Chat plugin (versions ≤ 4.6.4) is affected by an authenticated stored XSS due to the plugin outputting the APP ID setting without sanitization. Root cause: lack of proper sanitization of APP ID before page output. Impact:...

WordPress 跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress Plugin is a WordPress open source application plugin . A cross-site scripting vulnerability exists in iFlyChat -...

iFlyChat – WordPress Chat <= 4.6.4 - Authenticated Stored Cross-Site Scripting (XSS)

The plugin does not sanitise its APP ID setting before outputting it back in the page, leading to an authenticated Stored Cross-Site Scripting issue Step1: Install and activate the plugin "iFlyChat – WordPress Chat-4.6.4" Step2: Enter the following payload in the "APP ID" field of the plugin...

iFlyChat – WordPress Chat <= 4.6.4 - Authenticated Stored Cross-Site Scripting (XSS)

The plugin does not sanitise its APP ID setting before outputting it back in the page, leading to an authenticated Stored Cross-Site Scripting issue PoC Step1: Install and activate the plugin "iFlyChat – WordPress Chat-4.6.4" Step2: Enter the following payload in the "APP ID" field of the plugin...

WordPress iFlyChat – WordPress Chat plugin <= 4.6.4 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Kishore Hariram in WordPress iFlyChat – WordPress Chat plugin versions = 4.6.4. Solution Update the WordPress iFlyChat – WordPress Chat plugin to the latest available version at least 4.7.0...