Stored Cross-Site Scripting in Pure Chat Plugin for WordPress

CVE-2024-13736

What is CVE-2024-13736?

The Pure Chat – Live Chat & More! plugin for WordPress contains a vulnerability that allows unauthenticated attackers to exploit the ‘purechatWidgetName’ parameter. This occurs due to inadequate input sanitization and output escaping, enabling the injection of arbitrary web scripts into affected pages. When users access these compromised pages, malicious scripts can execute, potentially leading to data theft or site compromise.

References