PT-2018-10311 · WordPress · Wp-Live-Chat-Support

Riccardo Ten Cate · Publicado 2018-05-15 · Atualizado 2023-05-26 · CVE-2018-11105

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions wp-live-chat-support plugin versions prior to 8.0.08

Description The issue is related to stored cross-site scripting in the wp-live-chat-support plugin for WordPress. This occurs via the name (aka wplc name) and email (aka wplc email) input fields to the "/wp-json/wp live chat support/v1/start chat" API endpoint whenever a malicious attacker initiates a new chat with an administrator.

Recommendations For versions prior to 8.0.08, update to version 8.0.08 or later to resolve the issue. As a temporary workaround, consider restricting access to the "/wp-json/wp live chat support/v1/start chat" API endpoint to minimize the risk of exploitation. Additionally, avoid using the wplc name and wplc email input fields in the affected API endpoint until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-11105

Produtos afetados

Wp-Live-Chat-Support

Referências · 4

• 🔥 https://github.com/RiieCco/write-ups/tree/master/CVE-2018-11105 · Exploit
• https://osv.dev/vulnerability/CVE-2018-11105 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-11105 · Nota de Segurança
• https://wordpress.org/plugins/wp-live-chat-support/#developers · Correção