Stored Cross-Site Scripting Vulnerability in Chatroll Live Chat Plugin for WordPress

CVE-2024-12464

What is CVE-2024-12464?

The Chatroll Live Chat plugin for WordPress has a vulnerability that allows authenticated users with contributor-level access to inject malicious web scripts via the 'chatroll' shortcode. This occurs due to inadequate input sanitization and output escaping on user-supplied attributes, leading to the execution of scripts when a user accesses the compromised page. All versions of the plugin up to and including 2.5.0 are affected, posing significant security risks to WordPress installations.

References