Stored Cross-Site Scripting in Live Chat with Facebook Messenger Plugin for WordPress
CVE-2023-5740
6.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 25 October 2023
What is CVE-2023-5740?
The Live Chat with Facebook Messenger plugin for WordPress exposes users to a Stored Cross-Site Scripting (XSS) vulnerability through its 'messenger' shortcode. This issue arises from inadequate input sanitization and output escaping on user-supplied attributes, enabling authenticated attackers with contributor-level permissions and above to inject arbitrary web scripts. These scripts execute upon page access, potentially compromising user data and site integrity. It is crucial for site administrators to update to secure versions and implement best practices for input validation.
Affected Version(s)
Live Chat with Facebook Messenger * <= 1.0