CVE-2021-43353: Crisp Live Chat <= 0.31 Cross-Site Request Forgery to Stored Cross-Site Scr

Crisp Live Chat <= 0.31 Cross-Site Request Forgery to Stored Cross-Site Scripting

Status

Published

2022-01-18

Updated

2025-01-31

Assigning organization

Wordfence

Description

The Crisp Live Chat WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation via the crisp_plugin_settings_page function found in the ~/crisp.php file, which made it possible for attackers to inject arbitrary web scripts in versions up to, and including 0.31.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Crisp Live Chat Crisp Live Chat

0.31 to ≤ 0.31affected

References

https://www.wordfence.com/vulnerability-advisories/#CVE-2021-43353 ↗
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2643954%40crisp&new=2643954%40crisp&sfp_email=&sfph_mail= ↗