CVE-2015-2039
Acobot Live Chat & Contact Form 2.0 - Cross-Site Request Forgery
Title source: llmDescription
Multiple cross-site request forgery (CSRF) vulnerabilities in the Acobot Live Chat & Contact Form plugin 2.0 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings or (2) conduct cross-site scripting (XSS) attacks via the acobot_token parameter in the acobot page to wp-admin/options-general.php.
References (3)
Core 3
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/100813
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/100814
Exploit, Third Party Advisory x_refsource_misc
http://packetstormsecurity.com/files/130306/WordPress-Acobot-Live-Chat-And-Contact-Form-2.0-CSRF-XSS.html
Scores
EPSS
0.0120
EPSS Percentile
64.4%
Details
CWE
CWE-352
Status
published
Products (1)
acobot_live_chat_\&_contact_form_project/acobot_live_chat_\&_contact_form
2.0
Published
Feb 20, 2015
Tracked Since
Feb 18, 2026