CVE-2021-43353 – Crisp Live Chat <= 0.31 Cross-Site Request Forgery to Stored Cross-Site Scripting

https://notcve.org/view.php?id=CVE-2021-43353

The Crisp Live Chat WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation via the crisp_plugin_settings_page function found in the ~/crisp.php file, which made it possible for attackers to inject arbitrary web scripts in versions up to, and including 0.31. El plugin Crisp Live Chat de WordPress es vulnerable a un ataque de tipo Cross-Site Request Forgery debido a la falta de comprobación de nonce por medio de la función crisp_plugin_settings_page que es encontrada en el archivo ~/crisp.php, lo que permite a atacantes inyectar scripts web arbitrarios en las versiones hasta 0.31 incluyéndola • https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2643954%40crisp&new=2643954%40crisp&sfp_email=&sfph_mail= https://www.wordfence.com/vulnerability-advisories/#CVE-2021-43353 • CWE-352: Cross-Site Request Forgery (CSRF) •