Vulnerability database

317 results · page 6 of 7

• Jan 16, 2024Print Invoice & Delivery Notes for WooCommerce: Is vulnerable to reflected XSS by echoing a GET value in an admin note within the WooCommerce orders pageCVE-2023-0479 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The Print Invoice & Delivery Notes for WooCommerce WordPress plugin before 4.7.2 is vulnerable to reflected XSS by echoing a GET value in an admin note within the WooCommerce orders page. This means that this vulnerability can be exploited for users with the edit_others_shop_orders capability. WooCommerce must be installed and active. This vulnerability is caused by a urldecode() after cleanup with esc_url_raw(), allowing double encoding.

  Product

  Print Invoice & Delivery Notes for WooCommerce

  Fixed in

  4.7.2

  What to do

  Update Print Invoice & Delivery Notes for WooCommerce to 4.7.2 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Jan 11, 2024POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for: Unauthorized access of data and modification of dataCVE-2023-6875 · WordPress plugins & themes · reported by WordfenceCritical 9.8

  The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a type juggling issue on the connect-app REST endpoint in all versions up to, and including, 2.8.7. This makes it possible for unauthenticated attackers to reset the API key used to authenticate to the mailer and view logs, including password reset emails, allowing site takeover. CVE-2023-52233 appears to be a duplicate of this issue.

  Product

  POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for

  Affected

  up to 2.8.7

  What to do

  Affects up to 2.8.7. Update POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Jan 8, 2024Page Builder: Live Composer: Deserialization of Untrusted DataCVE-2023-52206 · WordPress plugins & themes · reported by PatchstackHigh 7.7

  Deserialization of Untrusted Data vulnerability in Live Composer Team Page Builder: Live Composer live-composer-page-builder.This issue affects Page Builder: Live Composer: from n/a through 1.5.25.

  Product

  Page Builder: Live Composer

  Affected

  up to 1.5.25

  What to do

  Affects up to 1.5.25. Update Page Builder: Live Composer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Jan 3, 2024WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels: Unauthorized access of dataCVE-2023-7068 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on theprint_packinglist action in all versions up to, and including, 4.3.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to export orders which can contain sensitive information.

  Product

  WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels

  Affected

  up to 4.3.0

  What to do

  Affects up to 4.3.0. Update WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Jan 3, 2024POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for: Stored Cross-Site ScriptingCVE-2023-7027 · WordPress plugins & themes · reported by WordfenceHigh 7.2

  The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘device’ header in all versions up to, and including, 2.8.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for

  Affected

  up to 2.8.7

  What to do

  Affects up to 2.8.7. Update POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Jan 3, 2024POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for: Reflected Cross-Site ScriptingCVE-2023-6629 · WordPress plugins & themes · reported by WordfenceMedium 6.1

  The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘msg’ parameter in all versions up to, and including, 2.8.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. CVE-2023-6621 appears to be a duplicate of this issue. CVE-2024-29128 appears to be a duplicate of this issue.

  Product

  POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for

  Affected

  up to 2.8.6

  What to do

  Affects up to 2.8.6. Update POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Dec 31, 2023Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-51423 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saleswonder Team Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition.This issue affects Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition: from n/a through 3.05.0.

  Product

  Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition

  Affected

  up to 3.05.0

  What to do

  Affects up to 3.05.0. Update Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Dec 29, 2023Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition: Deserialization of Untrusted DataCVE-2023-51422 · WordPress plugins & themes · reported by PatchstackCritical 9.9

  Deserialization of Untrusted Data vulnerability in Saleswonder Team Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition.This issue affects Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition: from n/a through 3.05.0.

  Product

  Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition

  Affected

  up to 3.05.0

  What to do

  Affects up to 3.05.0. Update Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Dec 29, 2023Sticky Chat Widget: Click to chat, SMS, Email, Messages, Call Button, Live Chat and Live Support Button: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51361 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ginger Plugins Sticky Chat Widget: Click to chat, SMS, Email, Messages, Call Button, Live Chat and Live Support Button allows Stored XSS.This issue affects Sticky Chat Widget: Click to chat, SMS, Email, Messages, Call Button, Live Chat and Live Support Button: from n/a through 1.1.8.

  Product

  Sticky Chat Widget: Click to chat, SMS, Email, Messages, Call Button, Live Chat and Live Support Button

  Affected

  up to 1.1.8

  What to do

  Affects up to 1.1.8. Update Sticky Chat Widget: Click to chat, SMS, Email, Messages, Call Button, Live Chat and Live Support Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Dec 20, 2023Olive One Click Demo Import: Unrestricted Upload of File with Dangerous TypeCVE-2023-29102 · WordPress plugins & themes · reported by PatchstackCritical 9.1

  Unrestricted Upload of File with Dangerous Type vulnerability in Olive Themes Olive One Click Demo Import.This issue affects Olive One Click Demo Import: from n/a through 1.1.1.

  Product

  Olive One Click Demo Import

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update Olive One Click Demo Import to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Dec 18, 2023LiveChat – WP live chat plugin for: Cross-Site Request Forgery (CSRF)CVE-2023-49821 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in LiveChat LiveChat – WP live chat plugin for WordPress.This issue affects LiveChat – WP live chat plugin for WordPress: from n/a through 4.5.15.

  Product

  LiveChat – WP live chat plugin for

  Affected

  up to 4.5.15

  What to do

  Affects up to 4.5.15. Update LiveChat – WP live chat plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Dec 14, 2023Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49168 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WordPlus Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss allows Stored XSS.This issue affects Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss: from n/a through 2.4.0.

  Product

  Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss

  Affected

  up to 2.4.0

  What to do

  Affects up to 2.4.0. Update Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Dec 14, 2023WPBakery Page Builder Addons by Livemesh: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-50370 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Livemesh WPBakery Page Builder Addons by Livemesh allows Stored XSS.This issue affects WPBakery Page Builder Addons by Livemesh: from n/a through 3.5.

  Product

  WPBakery Page Builder Addons by Livemesh

  Affected

  up to 3.5

  What to do

  Affects up to 3.5. Update WPBakery Page Builder Addons by Livemesh to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 22, 2023Cross-Site Request Forgery (CSRF) vulnerability in WPPOOL Sheets To WP Table Live Sync plugin <= 2.12.15 versions.CVE-2023-26535 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in WPPOOL Sheets To WP Table Live Sync plugin <= 2.12.15 versions.

  Affected

  up to 2.12.15

  What to do

  Affects up to 2.12.15. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Oct 31, 2023Live updates from Excel: Stored Cross-Site ScriptingCVE-2023-5116 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Live updates from Excel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ipushpull_page' shortcode in versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Live updates from Excel

  Affected

  up to 2.3.2

  What to do

  Affects up to 2.3.2. Update Live updates from Excel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Oct 25, 2023Live Chat with Facebook Messenger: Stored Cross-Site ScriptingCVE-2023-5740 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Live Chat with Facebook Messenger plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'messenger' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Live Chat with Facebook Messenger

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Live Chat with Facebook Messenger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Oct 10, 2023Cross-Site Request Forgery (CSRF) vulnerability in Ashok Rane Order Delivery Date for WP e-Commerce plugin <= 1.2 versions.CVE-2023-41858 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Ashok Rane Order Delivery Date for WP e-Commerce plugin <= 1.2 versions.

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Oct 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in DAEXT Live News plugin <= 1.06 versions.CVE-2023-41669 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in DAEXT Live News plugin <= 1.06 versions.

  Affected

  up to 1.06

  What to do

  Affects up to 1.06. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Jun 15, 2023Cross-Site Request Forgery (CSRF) vulnerability in Oliver Seidel, Bastian Germann cformsII plugin <= 15.0.4 versions.CVE-2023-25449 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Oliver Seidel, Bastian Germann cformsII plugin <= 15.0.4 versions.

  Fixed in

  15.0.5

  What to do

  Update the plugin to 15.0.5 or newer.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• May 8, 2023Pickup | Delivery | Dine-in date time: Does not sanitise and escape some of its settingsCVE-2023-0894 · WordPress plugins & themes · reported by WPScanMedium 4.8

  The Pickup | Delivery | Dine-in date time WordPress plugin through 1.0.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

  Product

  Pickup | Delivery | Dine-in date time

  Affected

  up to 1.0.9

  What to do

  Affects up to 1.0.9. Update Pickup | Delivery | Dine-in date time to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Apr 24, 2023Steveas WP Live Chat Shoutbox: Does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2023-1020 · WordPress plugins & themes · reported by WPScanCritical 9.8

  The Steveas WP Live Chat Shoutbox WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.

  Product

  Steveas WP Live Chat Shoutbox

  Affected

  up to 1.4.2

  What to do

  Affects up to 1.4.2. Update Steveas WP Live Chat Shoutbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Apr 24, 2023Steveas WP Live Chat Shoutbox: Does not sanitise and escape a parameter before outputting it back in the ShoutboxCVE-2023-0899 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The Steveas WP Live Chat Shoutbox WordPress plugin through 1.4.2 does not sanitise and escape a parameter before outputting it back in the Shoutbox, leading to Stored Cross-Site Scripting which could be used against high privilege users such as admins.

  Product

  Steveas WP Live Chat Shoutbox

  Affected

  up to 1.4.2

  What to do

  Affects up to 1.4.2. Update Steveas WP Live Chat Shoutbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Feb 21, 2023Page Builder: Live Composer: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4669 · WordPress plugins & themes · reported by WPScanMedium 5.4

  The Page Builder: Live Composer WordPress plugin before 1.5.23 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

  Product

  Page Builder: Live Composer

  Fixed in

  1.5.23

  What to do

  Update Page Builder: Live Composer to 1.5.23 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Dec 12, 2022Livemesh Addons for Elementor: Does not sanitise and escape some of its settingsCVE-2022-3862 · WordPress plugins & themes · reported by WPScanMedium 4.8

  The Livemesh Addons for Elementor WordPress plugin before 7.2.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

  Product

  Livemesh Addons for Elementor

  Fixed in

  7.2.4

  What to do

  Update Livemesh Addons for Elementor to 7.2.4 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Oct 25, 2022Retain Live Chat: Does not sanitise and escape some of its settingsCVE-2022-3391 · WordPress plugins & themes · reported by WPScanMedium 4.8

  The Retain Live Chat WordPress plugin through 0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

  Product

  Retain Live Chat

  Affected

  up to 0.1

  What to do

  Affects up to 0.1. Update Retain Live Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Aug 15, 2022SearchWP Live Ajax Search: Does not ensure that users making a live search are limited to published posts onlyCVE-2022-2535 · WordPress plugins & themes · reported by WPScanMedium 5.3

  The SearchWP Live Ajax Search WordPress plugin before 1.6.2 does not ensure that users making a live search are limited to published posts only, allowing unauthenticated users to make a crafted query disclosing private/draft/pending post titles along with their permalink

  Product

  SearchWP Live Ajax Search

  Fixed in

  1.6.2

  What to do

  Update SearchWP Live Ajax Search to 1.6.2 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Jul 18, 2022Free Live Chat Support: Cross-Site Request ForgeryCVE-2022-2039 · WordPress plugins & themes · reported by WordfenceHigh 8.8

  The Free Live Chat Support plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.0.11. This is due to missing nonce protection on the livesupporti_settings() function found in the ~/livesupporti.php file. This makes it possible for unauthenticated attackers to inject malicious web scripts into the page, granted they can trick a site's administrator into performing an action such as clicking on a link.

  Product

  Free Live Chat Support

  Affected

  up to 1.0.11

  What to do

  Affects up to 1.0.11. Update Free Live Chat Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Jun 27, 2022Flower Delivery by Florist One: Does not sanitise and escape some of its settingsCVE-2022-1113 · WordPress plugins & themes · reported by WPScanMedium 4.8

  The Flower Delivery by Florist One WordPress plugin through 3.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setups)

  Product

  Flower Delivery by Florist One

  Affected

  up to 3.7

  What to do

  Affects up to 3.7. Update Flower Delivery by Florist One to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Jun 8, 2022LiveSync for: Does not have CSRF check in placeCVE-2022-1712 · WordPress plugins & themes · reported by WPScanMedium 4.3

  The LiveSync for WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

  Product

  LiveSync for

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update LiveSync for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• May 30, 2022JivoChat Live Chat: Does not properly check CSRF tokens on POST requests to the plugins admin pageCVE-2022-0642 · WordPress plugins & themes · reported by WPScanMedium 5.4

  The JivoChat Live Chat WordPress plugin before 1.3.5.4 does not properly check CSRF tokens on POST requests to the plugins admin page, and does not sanitise some parameters, leading to a stored Cross-Site Scripting vulnerability where an attacker can trick a logged in administrator to inject arbitrary javascript.

  Product

  JivoChat Live Chat

  Fixed in

  1.3.5.4

  What to do

  Update JivoChat Live Chat to 1.3.5.4 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• May 16, 2022WP YouTube Live: Does not validateCVE-2022-1334 · WordPress plugins & themes · reported by WPScanMedium 4.8

  The WP YouTube Live WordPress plugin before 1.8.3 does not validate, sanitise and escape various of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

  Product

  WP YouTube Live

  Fixed in

  1.8.3

  What to do

  Update WP YouTube Live to 1.8.3 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Apr 19, 2022WordPress WP YouTube Live: Reflected Cross-Site ScriptingCVE-2022-1187 · WordPress plugins & themes · reported by WordfenceMedium 6.1

  The WordPress WP YouTube Live Plugin is vulnerable to Reflected Cross-Site Scripting via POST data found in the ~/inc/admin.php file which allows unauthenticated attackers to inject arbitrary web scripts in versions up to, and including, 1.7.21.

  Product

  WordPress WP YouTube Live

  Affected

  up to 1.7.21

  What to do

  Affects up to 1.7.21. Update WordPress WP YouTube Live to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org

• Feb 28, 2022WP Responsive Menu: Does not have capability and CSRF checks in the wpr_live_update AJAX actionCVE-2021-24971 · WordPress plugins & themes · reported by WPScanMedium 5.4

  The WP Responsive Menu WordPress plugin before 3.1.7.1 does not have capability and CSRF checks in the wpr_live_update AJAX action, as well as do not sanitise and escape some of the data submitted. As a result, any authenticated, such as subscriber could update the plugin's settings and perform Cross-Site Scripting attacks against all visitor and users on the frontend

  Product

  WP Responsive Menu

  Fixed in

  3.1.7.1

  What to do

  Update WP Responsive Menu to 3.1.7.1 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Jan 18, 2022Crisp Live Chat: Cross-Site Request ForgeryCVE-2021-43353 · WordPress plugins & themes · reported by WordfenceHigh 8.8

  The Crisp Live Chat WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation via the crisp_plugin_settings_page function found in the ~/crisp.php file, which made it possible for attackers to inject arbitrary web scripts in versions up to, and including 0.31.

  Product

  Crisp Live Chat

  Affected

  up to 0.31

  What to do

  Affects up to 0.31. Update Crisp Live Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Dec 6, 2021Tawk.To Live Chat: Does not have capability and CSRF checks in the tawkto_setwidget and tawkto_removewidget AJAX actionsCVE-2021-24914 · WordPress plugins & themes · reported by WPScanHigh 8

  The Tawk.To Live Chat WordPress plugin before 0.6.0 does not have capability and CSRF checks in the tawkto_setwidget and tawkto_removewidget AJAX actions, available to any authenticated user. The first one allows low-privileged users (including simple subscribers) to change the 'tawkto-embed-widget-page-id' and 'tawkto-embed-widget-widget-id' parameters. Any authenticated user can thus link the vulnerable website to their own Tawk.to instance. Consequently, they will be able to monitor the vulnerable website and interact with its visitors (receive contact messages, answer, ...). They will also be able to display an arbitrary Knowledge Base. The second one will remove the live chat widget from pages.

  Product

  Tawk.To Live Chat

  Fixed in

  0.6.0

  What to do

  Update Tawk.To Live Chat to 0.6.0 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• May 5, 2021Livemesh Addons for Elementor: Has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24260 · WordPress plugins & themes · reported by WPScanMedium 5.4

  The “Livemesh Addons for Elementor” WordPress Plugin before 6.8 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.

  Product

  Livemesh Addons for Elementor

  Fixed in

  6.8

  What to do

  Update Livemesh Addons for Elementor to 6.8 or newer.

  Full record and what to do →NVD recordwpscan.comwordfence.com

• Oct 14, 2020Live Chat - Live support version 3.1.0 and earlier: Cross-site request forgery (CSRF)CVE-2020-5642 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8

  Cross-site request forgery (CSRF) vulnerability in Live Chat - Live support version 3.1.0 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.

  Product

  Live Chat - Live support version 3.1.0 and earlier

  Affected

  up to 3.1.0

  What to do

  Affects up to 3.1.0. Update Live Chat - Live support version 3.1.0 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordjvn.jpplugins.trac.wordpress.org

• Mar 20, 2020The WP Live Chat Support plugin before 8.0.33 for WordPress accepts certain REST API calls without invoking the wplc_api_permission_check protection mechanism.CVE-2019-12498 · WordPress plugins & themes · reported by MITRECritical 9.8

  The WP Live Chat Support plugin before 8.0.33 for WordPress accepts certain REST API calls without invoking the wplc_api_permission_check protection mechanism.

  Product

  WP Live Chat Support

  Fixed in

  8.0.33

  What to do

  Update WP Live Chat Support to 8.0.33 or newer.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Aug 22, 2019The wp-live-chat-support plugin before 4.1.0 for WordPress has JavaScript injections.CVE-2014-10386 · WordPress plugins & themes · reported by MITREMedium 6.1

  The wp-live-chat-support plugin before 4.1.0 for WordPress has JavaScript injections.

  Product

  wp-live-chat-support

  Fixed in

  4.1.0

  What to do

  Update wp-live-chat-support to 4.1.0 or newer.

  Full record and what to do →NVD recordwordpress.orgwordpress.org

• Aug 13, 2019The wp-live-chat-support plugin before 7.1.05 for WordPress has XSS.CVE-2017-18507 · WordPress plugins & themes · reported by MITREMedium 6.1

  The wp-live-chat-support plugin before 7.1.05 for WordPress has XSS.

  Product

  wp-live-chat-support

  Fixed in

  7.1.05

  What to do

  Update wp-live-chat-support to 7.1.05 or newer.

  Full record and what to do →NVD recordwordpress.orgwordpress.org

• Aug 13, 2019The liveforms plugin before 3.4.0 for WordPress has XSS.CVE-2017-18497 · WordPress plugins & themes · reported by MITREMedium 6.1

  The liveforms plugin before 3.4.0 for WordPress has XSS.

  Product

  liveforms

  Fixed in

  3.4.0

  What to do

  Update liveforms to 3.4.0 or newer.

  Full record and what to do →NVD recordwordpress.orgwordpress.org

• Aug 13, 2019The liveforms plugin before 3.2.0 for WordPress has SQL injection.CVE-2015-9301 · WordPress plugins & themes · reported by MITRECritical 9.8

  The liveforms plugin before 3.2.0 for WordPress has SQL injection.

  Product

  liveforms

  Fixed in

  3.2.0

  What to do

  Update liveforms to 3.2.0 or newer.

  Full record and what to do →NVD recordwordpress.orgwordpress.org

• Aug 12, 2019The wp-live-chat-support plugin before 8.0.27 for WordPress has XSS via the GDPR page.CVE-2019-14950 · WordPress plugins & themes · reported by MITREMedium 6.1

  The wp-live-chat-support plugin before 8.0.27 for WordPress has XSS via the GDPR page.

  Product

  wp-live-chat-support

  Fixed in

  8.0.27

  What to do

  Update wp-live-chat-support to 8.0.27 or newer.

  Full record and what to do →NVD recordwordpress.orgwordpress.org

• Aug 12, 2019The wp-live-chat-support plugin before 7.1.03 for WordPress has XSS.CVE-2017-18508 · WordPress plugins & themes · reported by MITREMedium 6.1

  The wp-live-chat-support plugin before 7.1.03 for WordPress has XSS.

  Product

  wp-live-chat-support

  Fixed in

  7.1.03

  What to do

  Update wp-live-chat-support to 7.1.03 or newer.

  Full record and what to do →NVD recordwordpress.orgwpvulndb.com

• Aug 12, 2019The wp-live-chat-support plugin before 6.2.02 for WordPress has XSS.CVE-2016-10879 · WordPress plugins & themes · reported by MITREMedium 6.1

  The wp-live-chat-support plugin before 6.2.02 for WordPress has XSS.

  Product

  wp-live-chat-support

  Fixed in

  6.2.02

  What to do

  Update wp-live-chat-support to 6.2.02 or newer.

  Full record and what to do →NVD recordwordpress.orgwordpress.org

• Jun 3, 2019The WP Live Chat Support Pro plugin through 8.0.26 for WordPress contains an arbitrary file upload vulnerability.CVE-2019-11185 · WordPress plugins & themes · reported by MITRECritical 9.8

  The WP Live Chat Support Pro plugin through 8.0.26 for WordPress contains an arbitrary file upload vulnerability. This results from an incomplete patch for CVE-2018-12426. Arbitrary file upload is achieved by using a non-blacklisted executable file extension in conjunction with a whitelisted file extension, and prepending "magic bytes" to the payload to pass MIME checks. Specifically, an unauthenticated remote user submits a crafted file upload POST request to the REST api remote_upload endpoint. The file contains data that will fool the plugin's MIME check into classifying it as an image (which is a whitelisted file extension) and finally a trailing .phtml file extension.

  Product

  WP Live Chat Support Pro

  Affected

  up to 8.0.26

  What to do

  Affects up to 8.0.26. Update WP Live Chat Support Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwordpress.orgwp-livechat.com

• Mar 21, 2019The wp-live-chat-support plugin before 8.0.18 for WordPress has wp-admin/admin.php?page=wplivechat-menu-gdpr-page term XSS.CVE-2019-9913 · WordPress plugins & themes · reported by MITREMedium 6.1

  The wp-live-chat-support plugin before 8.0.18 for WordPress has wp-admin/admin.php?page=wplivechat-menu-gdpr-page term XSS.

  Product

  wp-live-chat-support

  Fixed in

  8.0.18

  What to do

  Update wp-live-chat-support to 8.0.18 or newer.

  Full record and what to do →NVD recordseclists.orglists.openwall.net

• Oct 18, 2018XSS exists in the wp-live-chat-support v8.0.15 plugin for WordPress via the modules/gdpr.php term parameter in a wp-admin/admin.php wplivechat-menu-gdpr-page reCVE-2018-18460 · WordPress plugins & themes · reported by MITREMedium 6.1

  XSS exists in the wp-live-chat-support v8.0.15 plugin for WordPress via the modules/gdpr.php term parameter in a wp-admin/admin.php wplivechat-menu-gdpr-page request.

  Affected

  8.0.15 to 8.0.15

  What to do

  Affects 8.0.15 to 8.0.15. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordgithub.comwordpress.org

• Jul 2, 2018WP Live Chat Support Pro plugin before 8.0.07: Unauthenticated Remote Code ExecutionCVE-2018-12426 · WordPress plugins & themes · reported by MITRECritical 9.8

  The WP Live Chat Support Pro plugin before 8.0.07 for WordPress is vulnerable to unauthenticated Remote Code Execution due to client-side validation of allowed file types, as demonstrated by a v1/remote_upload request with a .php filename and the image/jpeg content type.

  Product

  WP Live Chat Support Pro plugin before 8.0.07

  Fixed in

  8.0.07

  What to do

  Update WP Live Chat Support Pro plugin before 8.0.07 to 8.0.07 or newer.

  Full record and what to do →NVD recordgithub.comgithub.com

• May 15, 2018There is stored cross site scripting in the wp-live-chat-support plugin before 8.0.08 for WordPress via the "name" (aka wplc_name) and "email" (aka wplc_email) CVE-2018-11105 · WordPress plugins & themes · reported by MITREMedium 6.1

  There is stored cross site scripting in the wp-live-chat-support plugin before 8.0.08 for WordPress via the "name" (aka wplc_name) and "email" (aka wplc_email) input fields to wp-json/wp_live_chat_support/v1/start_chat whenever a malicious attacker would initiate a new chat with an administrator. NOTE: this issue exists because of an incomplete fix for CVE-2018-9864.

  Product

  There is stored cross site scripting in the wp-live-chat-support

  Fixed in

  8.0.08

  What to do

  Update There is stored cross site scripting in the wp-live-chat-support to 8.0.08 or newer.

  Full record and what to do →NVD recordgithub.comwordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.