PT-2026-46207 · Screets · Live Chat Unlimited

M0Ze · Published 2026-06-04 · Updated 2026-06-04 · CVE-2019-25737

NVD

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Live Chat Unlimited 2.8.3 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts through the chat input field. Attackers can submit payloads containing script tags and event handlers that execute in the admin area, enabling cookie theft or forced redirects to malicious websites.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-25737

Affected Products

Live Chat Unlimited

References · 5

• 🔥 https://exploit-db.com/exploits/47037 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-25737 · Security Note
• https://codecanyon.net/item/wordpress-live-chat-plugin/3952877 · Note
• https://screets.com · Note
• https://vulncheck.com/advisories/live-chat-unlimited-stored-cross-site-scripting · Note