PT-2025-29196 · WordPress · Livehelperchat Lhc-Php-Resque Extension

Jay Shah · Published 2025-07-11 · Updated 2025-07-11 · CVE-2025-7435

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: LiveHelperChat lhc-php-resque Extension versions up to ee1270b35625f552425e32a6a3061cd54b5085c4

Description: A problematic issue exists in LiveHelperChat lhc-php-resque Extension. The manipulation of the queue name argument within the List Handler component, specifically affecting an unknown part of the file /site admin/lhcphpresque/list/, leads to cross site scripting. The attack can be initiated remotely, and the exploit has been publicly disclosed. The product utilizes a rolling release approach, and therefore specific version details for affected and updated releases are unavailable.

Recommendations: Apply the patch with identifier 542aa8449b5aa889b3a54f419e794afe19f56d5d/0ce7b4f1193c0ed6c6e31a960fafededf979eef2 to fix this issue.

Exploit

Fix

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2025-7435

Affected Products

Livehelperchat Lhc-Php-Resque Extension

References · 12

• 🔥 https://github.com/CodeBrics/lhc-php-resque-exploit/?tab=readme-ov-file#attack-vector · Exploit
• 🔥 https://github.com/CodeBrics/lhc-php-resque-exploit · Exploit
• https://github.com/LiveHelperChat/lhc-php-resque/commit/542aa8449b5aa889b3a54f419e794afe19f56d5d · Patch
• https://osv.dev/vulnerability/CVE-2025-7435 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-7435 · Security Note
• https://twitter.com/VulmonFeeds/status/1943515222280458320 · Twitter Post
• https://t.me/cvetracker/27523 · Telegram Post
• https://vuldb.com/?id.316005 · Note
• https://t.me/cvenotify/128490 · Telegram Post
• https://vuldb.com/?ctiid.316005 · Note
• https://twitter.com/CVEnew/status/1943668146730405983 · Twitter Post
• https://vuldb.com/?submit.609068 · Note