CVE-2022-0642
JivoChat < 1.3.5.4 - Stored Cross-Site Scripting via CSRF
MEDIUM 5.4EPSS 0.3%
The JivoChat Live Chat WordPress plugin before 1.3.5.4 does not properly check CSRF tokens on POST requests to the plugins admin page, and does not sanitise some parameters, leading to a stored Cross-Site Scripting vulnerability where an attacker can trick a logged in administrator to inject arbitrary javascript.
- Affected
- JivoChat Live Chat – WP live chat plugin for WordPress
- CVSS v3.1 NVD
- 5.4 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - CVSS v2.0 NVD
- 3.5 LOW
AV:N/AC:M/Au:S/C:N/I:P/A:N - EPSS
- 0.31% chance of exploitation in the next 30 days, 22nd percentile
- Published
- 2022-05-30
- Updated
- 2024-08-02