CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-27963 – WordPress Crisp – Live Chat and Chatbot plugin <= 0.44 - Cross Site Scripting (XSS) vulnerability
https://notcve.org/view.php?id=CVE-2024-27963
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crisp allows Stored XSS.This issue affects Crisp: from n/a through 0.44. La vulnerabilidad de neutralización inadecuada de la entrada durante la generación de páginas web ('cross-site Scripting') en Crisp permite almacenar XSS. Este problema afecta a Crisp: desde n/a hasta 0.44. The Crisp plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 0.44 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. • https://patchstack.com/database/vulnerability/crisp/wordpress-crisp-live-chat-and-chatbot-plugin-0-44-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-43353 – Crisp Live Chat <= 0.31 Cross-Site Request Forgery to Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2021-43353
The Crisp Live Chat WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation via the crisp_plugin_settings_page function found in the ~/crisp.php file, which made it possible for attackers to inject arbitrary web scripts in versions up to, and including 0.31. El plugin Crisp Live Chat de WordPress es vulnerable a un ataque de tipo Cross-Site Request Forgery debido a la falta de comprobación de nonce por medio de la función crisp_plugin_settings_page que es encontrada en el archivo ~/crisp.php, lo que permite a atacantes inyectar scripts web arbitrarios en las versiones hasta 0.31 incluyéndola • https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2643954%40crisp&new=2643954%40crisp&sfp_email=&sfph_mail= https://www.wordfence.com/vulnerability-advisories/#CVE-2021-43353 • CWE-352: Cross-Site Request Forgery (CSRF) •