Stored Cross-Site Scripting in Live Chat with Facebook Messenger Plugin for WordPress
CVE-2023-5740

5.4MEDIUM

Key Information:

Vendor: Wordpress
Status: Live Chat with Facebook Messenger
Vendor: CVE Published:; 25 October 2023

Summary

The Live Chat with Facebook Messenger plugin for WordPress exposes users to a Stored Cross-Site Scripting (XSS) vulnerability through its 'messenger' shortcode. This issue arises from inadequate input sanitization and output escaping on user-supplied attributes, enabling authenticated attackers with contributor-level permissions and above to inject arbitrary web scripts. These scripts execute upon page access, potentially compromising user data and site integrity. It is crucial for site administrators to update to secure versions and implement best practices for input validation.

Affected Version(s)

Live Chat with Facebook Messenger * <= 1.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...

https://plugins.trac.wordpress.org/browser/wp-facebook-me...

CVSS V3.1

Score:

5.4

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

Required

Scope:

Changed

Timeline

Vulnerability published
Oct 25, 2023
Vulnerability Reserved
Oct 24, 2023

Credit

Lana Codes