CVE-2021-25016

MEDIUMNuclei

Chaty < 2.8.3 - Reflected Cross-Site Scripting

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2021-25016 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The Chaty WordPress plugin before 2.8.3 and Chaty Pro WordPress plugin before 2.8.2 do not sanitise and escape the search parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Affected products and versions

2
ProductSourceVersion range

Floating Chat Widget Pro - Chaty Pro

CVE List2.8.2 to < 2.8.2affected

Floating Chat Widget: Contact Icons, Messages, Telegram, Email, SMS, Call Button – Chaty

CVE List2.8.3 to < 2.8.3affected

Nuclei templates

1
ProjectDiscoveryMEDIUMChaty < 2.8.2 - Cross-Site ScriptingCVSS 6.1

The Chaty WordPress plugin before 2.8.3 and Chaty Pro WordPress plugin before 2.8.2 do not sanitise and escape the search parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting.

Impact

Attackers can inject malicious JavaScript via reflected XSS in the search parameter, potentially stealing administrator session cookies or accessing chat configuration data.

Remediation

Fixed in 2.8.3

WeaknessesCWE-79
Authorsluisfelipe146
Template tagscve2021cvewpscanwordpresswp-pluginxssauthenticatedchatypremiovuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:premio:chaty:*:*:*:*:*:wordpress:*:*
Shodan: http.html:/wp-content/plugins/chaty/
FOFA: body=/wp-content/plugins/chaty/
https://wpscan.com/vulnerability/b5035987-6227-4fc6-bc45-1e8016e5c4c0 https://nvd.nist.gov/vuln/detail/CVE-2021-25016 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25016

Source: ProjectDiscovery

References

2