CVE-2022-0642CWE-352

JivoChat < 1.3.5.4 - Stored Cross-Site Scripting via CSRF

published May 30, 2022

CVSS
—
EPSS
0%
Percentile
22.4
In the wild
Unconfirmed
What it is

The JivoChat Live Chat WordPress plugin before 1.3.5.4 does not properly check CSRF tokens on POST requests to the plugins admin page, and does not sanitise some parameters, leading to a stored Cross-Site Scripting vulnerability where an attacker can trick a logged in administrator to inject arbitrary javascript.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00309 · 22.4th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2022-05-30T08:35Z
EPSS history
Timeline
  • 30 MAY 08:35Z
    JivoChat < 1.3.5.4 - Stored Cross-Site Scripting via CSRF
    cvelistv5