WP Live Chat Support <= 8.0.27 — Stored Cross-Site Scripting

wp-live-chat-support plugin before 8.0.27 for WordPress contains a reflected cross-site scripting caused by insufficient sanitization in the GDPR page, letting attackers execute arbitrary scripts in the context of the victim's browser, exploit requires victim to visit a malicious page. id:...

CVE-2019-11185

The WP Live Chat Support Pro plugin through 8.0.26 for WordPress contains an arbitrary file upload vulnerability. This results from an incomplete patch for CVE-2018-12426. Arbitrary file upload is achieved by using a non-blacklisted executable file extension in conjunction with a whitelisted file...

EUVD-2019-19268

Malware in sbrugna...

EUVD-2018-21456

Malware in sbrugna...

EUVD-2017-11370

Malware in sbrugna...

EUVD-2017-9623

Malware in sbrugna...

EUVD-2016-1873

Malware in sbrugna...

EUVD-2018-3147

Malware in sbrugna...

EUVD-2018-10188

Malware in sbrugna...

EUVD-2017-9624

Malware in sbrugna...

CVE-2019-12498

The WP Live Chat Support plugin before 8.0.33 for WordPress accepts certain REST API calls without invoking the wplcapipermissioncheck protection mechanism...

CVE-2019-14950

The wp-live-chat-support plugin before 8.0.27 for WordPress has XSS via the GDPR page...

CVE-2017-18507

The wp-live-chat-support plugin before 7.1.05 for WordPress has XSS...

CVE-2019-12498

The WP Live Chat Support plugin before 8.0.33 for WordPress accepts certain REST API calls without invoking the wplcapipermissioncheck protection mechanism...

CVE-2019-12498

The CVE-2019-12498 entry affects the WordPress WP Live Chat Support plugin, where versions prior to 8.0.33 allow unauthenticated REST API access because the wplc_api_permission_check protection is not invoked. Public sources (NVD, Red Hat, CVE lists) describe this as an API-authentication bypass ...

CVE-2019-12498: Missing Authorization

The WP Live Chat Support plugin before 8.0.33 for WordPress accepts certain REST API calls without invoking the wplcapipermissioncheck protection mechanism...

Design/Logic Flaw

The wp-live-chat-support plugin before 4.1.0 for WordPress has JavaScript injections...

CVE-2014-10386

The wp-live-chat-support plugin before 4.1.0 for WordPress has JavaScript injections...

CVE-2014-10386

The vulnerability CVE-2014-10386 affects the WordPress wp-live-chat-support plugin prior to version 4.1.0 and involves JavaScript injections. Affected software: wp-live-chat-support plugin for WordPress. Root cause: improper handling of input allowing injection of JavaScript into the plugin’s con...

CVE-2014-10386: Improper Neutralization of Special Elements in Output Used by a Downstream Component

The wp-live-chat-support plugin before 4.1.0 for WordPress has JavaScript injections...