Lucene search
WpvulndbWPVDB-ID:09383587-8251-4955-A48A-70AE0BDC228EHistoryDec 16, 2021 - 12:00 a.m.
Crisp Live Chat < 0.32 - CSRF to Stored Cross-Site Scripting
2021-12-1600:00:00
wpscan.com
20
crisp live chat
cross-site request forgery
stored cross-site scripting
plugin vulnerability
nonce validation
web scripts
version 0.31
EPSS
0.001
Percentile
41.8%
The plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation via the crisp_plugin_settings_page function found in the ~/crisp.php file, which made it possible for attackers to inject arbitrary web scripts in versions up to, and including 0.31.
Related
cvelist
cvelist
prion
prion
Cross site request forgery (csrf)
2022-01-18 17:15:00
patchstack
patchstack
nvd
nvd
CVE-2021-43353
2022-01-18 17:15:09
cve
cve
CVE-2021-43353
2022-01-18 17:15:09
cnvd
cnvd
WordPress Crisp Live Chat plugin cross-site scripting vulnerability
2022-01-21 00:00:00