CVE-2024-2837

CVE-2024-2837 affects the WP Chat App WordPress plugin, prior to version 3.6.4. The vulnerability arises because the plugin does not sanitize and escape some settings, enabling high-privilege users (e.g., admins) to perform Cross-Site Scripting even when unfiltered_html is disallowed. Impact is d...

CVE-2023-51370

CVE-2023-51370 affects the WordPress WP Chat App plugin (NinjaTeam) up to version 3.4.4. The vulnerability is a Stored XSS caused by improper neutralization of user input during web page generation. PatchStack lists a fix in version 3.4.5; there are no explicit exploitation details in the provide...

CVE-2024-10533

CVE-2024-10533 (WP Chat App, WordPress) : A missing authorization check in ajax_install_plugin() across versions up to and including 3.6.8 allows authenticated users with Subscriber+ privileges to install the filebird plugin. Public CVE reports confirm exploitation risks are tied to Broken Access...

CVE-2024-2513

CVE-2024-2513 affects WordPress WP Chat App plugin up to version 3.6.2. The issue is Stored XSS via the imageAlt block attribute caused by insufficient input sanitization and output escaping, exploitable by authenticated attackers with contributor-level access or higher. Remediation: upgrade to a...

CVE-2024-1761

CVE-2024-1761 : The WP Chat App plugin for WordPress is vulnerable to stored Cross‑Site Scripting via its widget/block attributes (notably buttonColor and phoneNumber) in all versions up to and including 3.6.1. This can allow authenticated attackers with contributor level or higher to inject arbi...

CVE-2024-4664

CVE-2024-4664: WP Chat App WordPress plugin (pre-3.6.5) suffers from improper sanitisation/escaping of certain settings, enabling admin-level stored XSS. All available connected details confirm the issue is a stored XSS in the plugin’s settings; remediation is upgrading to version 3.6.5 or later ...