PT-2018-10311 · WordPress · Wp-Live-Chat-Support

Riccardo Ten Cate · Published 2018-05-15 · Updated 2023-05-26 · CVE-2018-11105

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions wp-live-chat-support plugin versions prior to 8.0.08

Description The issue is related to stored cross-site scripting in the wp-live-chat-support plugin for WordPress. This occurs via the name (aka wplc name) and email (aka wplc email) input fields to the "/wp-json/wp live chat support/v1/start chat" API endpoint whenever a malicious attacker initiates a new chat with an administrator.

Recommendations For versions prior to 8.0.08, update to version 8.0.08 or later to resolve the issue. As a temporary workaround, consider restricting access to the "/wp-json/wp live chat support/v1/start chat" API endpoint to minimize the risk of exploitation. Additionally, avoid using the wplc name and wplc email input fields in the affected API endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-11105

Affected Products

Wp-Live-Chat-Support

References · 4

• 🔥 https://github.com/RiieCco/write-ups/tree/master/CVE-2018-11105 · Exploit
• https://osv.dev/vulnerability/CVE-2018-11105 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-11105 · Security Note
• https://wordpress.org/plugins/wp-live-chat-support/#developers · Patch