CVE-2019-14950

MEDIUMNuclei

3cx live_chat Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Title source: VulnCheck
STIX 2.1 vulnerability

Record summary

CVE-2019-14950 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The wp-live-chat-support plugin before 8.0.27 for WordPress has XSS via the GDPR page.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · May 15, 2019 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

live_chat

Browse 3cx / live_chat
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryMEDIUMWP Live Chat Support <= 8.0.27 — Stored Cross-Site ScriptingCVSS 6.1

wp-live-chat-support plugin before 8.0.27 for WordPress contains a reflected cross-site scripting caused by insufficient sanitization in the GDPR page, letting attackers execute arbitrary scripts in the context of the victim's browser, exploit requires victim to visit a malicious page.

Impact

Attackers can execute arbitrary scripts in the victim's browser, potentially leading to session hijacking or defacement.

Remediation

Update to version 8.0.27 or later.

WeaknessesCWE-79
Authorsdaffainfo
Template tagscvecve2019wordpresswpwp-pluginwp-live-chat-supportxssintrusivevkev
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:3cx:live_chat:*:*:*:*:*:wordpress:*:*
https://wordpress.org/plugins/wp-live-chat-support/#developers https://blog.sucuri.net/2019/05/persistent-cross-site-scripting-in-wp-live-chat-support-plugin.html https://nvd.nist.gov/vuln/detail/CVE-2019-14950

Source: ProjectDiscovery

References

2