CVE Database /
CVE-2018-9864
CVE · Medium
CVE-2018-9864 — 3CX Free Live Chat, Calls & Messaging [wp-live-chat-support] < 8.0.06
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2018-9864
|
3CX Free Live Chat, Calls & Messaging [wp-live-chat-support] < 8.0.06 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Medium
6.1
|
< 8.0.06
|
8.0.06 |
2018-04-09 |
—
|
CVE-2018-9864
The WP Live Chat Support plugin before version 8.0.06 contains a stored cross-site scripting vulnerability where attackers without authentication can inject malicious JavaScript through the "Name" text field, which then executes within the admin panel on the wplivechat-menu-history page. The flaw stems from insufficient input sanitization of the $result->id variable in wp-live-chat-support.php at line 4439. Version 8.0.05 and likely earlier versions are affected, with the issue resolved in version 8.0.06.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings