Cross-Site Scripting Vulnerability in WP Live Chat Support by WordPress
CVE-2017-2187

6.1MEDIUM

Key Information:

Vendor

WordPress
Status
WP Live Chat Support
Vendor
CVE Published:
9 June 2017

What is CVE-2017-2187?

A cross-site scripting vulnerability in the WP Live Chat Support plugin allows remote attackers to inject arbitrary web scripts or HTML into the application. This can lead to various security issues, including user data compromise and session hijacking. The flaw exists in versions prior to 7.0.07, enabling attackers to execute malicious code in the context of the affected site's users. It is crucial for users to update to the latest version to mitigate this risk.

Affected Version(s)

WP Live Chat Support prior to version 7.0.07

References

https://plugins.trac.wordpress.org/changeset/1658232/
x_refsource_CONFIRM
http://jvn.jp/en/jp/JVN70951878/index.html
third-party-advisoryx_refsource_JVN

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.