WordPress Simple Ajax Chat plugin <= 20220115 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability
CVE-2022-25610

3.4LOW

Key Information:

Vendor
WordPress
Status
Simple Ajax Chat (WordPress Plugin)
Vendor
CVE Published:
25 March 2022

Summary

Unauthenticated Stored Cross-Site Scripting (XSS) in Simple Ajax Chat <= 20220115 allows an attacker to store the malicious code. However, the attack requires specific conditions, making it hard to exploit.

Affected Version(s)

Simple Ajax Chat (WordPress plugin) <= 20220115 <= 20220115

References

https://wordpress.org/plugins/simple-ajax-chat/#developers
x_refsource_CONFIRM
https://patchstack.com/database/vulnerability/simple-ajax...
x_refsource_CONFIRM

CVSS V3.1

Score:
3.4
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Vulnerability discovered by Philippe Dourassov (Patchstack Alliance)
.