Stored Cross-Site Scripting in Live Chat with Facebook Messenger Plugin for WordPress

CVE-2023-5740

What is CVE-2023-5740?

The Live Chat with Facebook Messenger plugin for WordPress exposes users to a Stored Cross-Site Scripting (XSS) vulnerability through its 'messenger' shortcode. This issue arises from inadequate input sanitization and output escaping on user-supplied attributes, enabling authenticated attackers with contributor-level permissions and above to inject arbitrary web scripts. These scripts execute upon page access, potentially compromising user data and site integrity. It is crucial for site administrators to update to secure versions and implement best practices for input validation.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References