CVE-2026-96388

Cross-Site Request Forgery CSRF vulnerability in Drupal Tawk.to - Live chat application allows Cross Site Request Forgery. This issue affects Tawk.to - Live chat application versions: from 0.0.0 to 3.0.4...

CVE-2026-96388 Tawk.to - Live chat application - Critical - Cross Site Request Forgery - SA-CONTRIB-2026-184

Cross-Site Request Forgery CSRF vulnerability in Drupal Tawk.to - Live chat application allows Cross Site Request Forgery. This issue affects Tawk.to - Live chat application versions: from 0.0.0 to 3.0.4...

CVE-2026-96388

The Drupal Tawk.to - Live chat application (versions 0.0.0 through 3.0.4 ) is vulnerable to a Cross-Site Request Forgery (CSRF) issue. The root cause is that the module fails to sufficiently validate certain requests, which could allow an attacker to trick an authenticated user into performing un...

EUVD-2026-107817

Cross-Site Request Forgery CSRF vulnerability in Drupal Tawk.to - Live chat application allows Cross Site Request Forgery. This issue affects Tawk.to - Live chat application versions: from 0.0.0 to 3.0.4...

CVE-2026-96388 Tawk.to - Live chat application - Critical - Cross Site Request Forgery - SA-CONTRIB-2026-184

Cross-Site Request Forgery CSRF vulnerability in Drupal Tawk.to - Live chat application allows Cross Site Request Forgery. This issue affects Tawk.to - Live chat application versions: from 0.0.0 to 3.0.4...

CVE-2026-96388 Tawk.to - Live chat application - Critical - Cross Site Request Forgery - SA-CONTRIB-2026-184

Cross-Site Request Forgery CSRF vulnerability in Drupal Tawk.to - Live chat application allows Cross Site Request Forgery. This issue affects Tawk.to - Live chat application versions: from 0.0.0 to 3.0.4...

DRUPAL-CONTRIB-2026-184

This module provides integration of the tawk.to live chat for Drupal sites. The module does not sufficiently validate certain requests. This may allow an attacker to trick an authenticated user into performing unintended actions through a Cross-Site Request Forgery CSRF vulnerability...

PT-2026-97678

Name of the Vulnerable Software and Affected Versions Drupal Tawk.to - Live chat application versions 0.0.0 through 3.0.4 Description Cross-Site Request Forgery CSRF occurs when the module does not sufficiently validate certain requests. This allows an attacker to trick an authenticated user into...

EUVD-2025-22733

Malicious code in bioql PyPI...

CVE-2025-45960

Cross Site Scripting vulnerability in tawk.to Live Chat v.1.6.1 allows a remote attacker to execute arbitrary code via the web application stores and displays user-supplied input without proper input validation or encoding...

CVE-2025-45960

Cross Site Scripting vulnerability in tawk.to Live Chat v.1.6.1 allows a remote attacker to execute arbitrary code via the web application stores and displays user-supplied input without proper input validation or encoding...

CVE-2025-45960

Cross Site Scripting vulnerability in tawk.to Live Chat v.1.6.1 allows a remote attacker to execute arbitrary code via the web application stores and displays user-supplied input without proper input validation or encoding...

CVE-2025-45960: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting vulnerability in tawk.to Live Chat v.1.6.1 allows a remote attacker to execute arbitrary code via the web application stores and displays user-supplied input without proper input validation or encoding...

CVE-2025-45960

The tawk.to Live Chat application (version 1.6.1 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the lack of proper input validation or encoding when the web application stores and subsequently displays user-supplied data. An attacker can inject malicious HTML tags ...

PT-2025-30900

Name of the Vulnerable Software and Affected Versions tawk.to Live Chat version 1.6.1 Description A Cross Site Scripting issue exists in tawk.to Live Chat. The web application stores and displays user-supplied input without proper input validation or encoding, potentially allowing a remote attack...

tawk.to Live Chat has a security vulnerability

tawk.to Live Chat is an online chat software from the US-based company tawk.to. A security vulnerability exists in tawk.to Live Chat version 1.6.1, which stems from insufficient input validation and could lead to cross-site scripting...

CVE-2025-45960

Cross Site Scripting vulnerability in tawk.to Live Chat v.1.6.1 allows a remote attacker to execute arbitrary code via the web application stores and displays user-supplied input without proper input validation or encoding...

WordPress Tawk.To Live Chat Plugin < 0.6.0 Broken Access Control Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:tawk:tawk.tolivechat"; if description...

WordPress Tawk.To Live Chat plugin cross-site request forgery vulnerability

WordPress is the WordPress Foundation's set of blogging platforms developed using the PHP language. The platform supports the hosting of personal blogging sites on PHP and MySQL servers. WordPress Tawk.To Live Chat plugin in versions prior to 0.6.0 suffers from a cross-site request forgery...

CVE-2021-24914

The Tawk.To Live Chat WordPress plugin before 0.6.0 does not have capability and CSRF checks in the tawktosetwidget and tawktoremovewidget AJAX actions, available to any authenticated user. The first one allows low-privileged users including simple subscribers to change the...