TI-2023-28029 Aliases CVE-2023-51371 GHSA-v2xm-vc3c-5672

WordPress Bit Assist Plugin <= 1.1.9 is vulnerable to Cross Site Scripting (XSS)

LOW 26CWE-79Published 2023-12-29 · Updated 2026-04-28

Key facts

Attack vector: Network
Privileges required: High
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · Low
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bit Assist Chat Widget: WhatsApp Chat, Facebook Messenger Chat, Telegram Chat Bubble, Line Messenger, Live Chat Support Chat Button, WeChat, SMS, Call Button, Customer Support Button with floating Chat Widget allows Stored XSS.This issue affects Chat Widget: WhatsApp Chat, Facebook Messenger Chat, Telegram Chat Bubble, Line Messenger, Live Chat Support Chat Button, WeChat, SMS, Call Button, Customer Support Button with floating Chat Widget: from n/a through 1.1.9.

Why it matters now

EPSS 0.00328 26th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Bit Assist	Chat Widget: WhatsApp Chat, Facebook Messenger Chat, Telegram Chat Bubble, Line Messenger, Live Chat Support Chat Button, WeChat, SMS, Call Button, Customer Support Button with floating Chat Widget	up to 1.1.9	—	No fix listed	CNA

Chat Widget: WhatsApp Chat, Facebook Messenger Chat, Telegram Chat Bubble, Line Messenger, Live Chat Support Chat Button, WeChat, SMS, Call Button, Customer Support Button with floating Chat Widget VendorBit Assist Affected up to 1.1.9 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:bitapps:bit_assist::::::wordpress::*	up to 1.1.9	Vulnerable	bitpressadmin

cpe:2.3:a:bitapps:bit_assist:*:*:*:*:*:wordpress:*:* Versions up to 1.1.9 Vulnerable ·bitpressadmin

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2023-51371
2026-10-03 Alias added: GHSA-v2xm-vc3c-5672

References

Advisory 1

https://patchstack.com/database/vulnerability/bit-assist/wordpress-chat-button-plugin-1-1-9-cross-site-scripting-xss-vulnerability?_s_id=cve

TI-2023-03424 Bit Assist < 1.1.9 - Admin+ Stored Cross-Site Scripting CVSS 3.1MEDIUM 4.8
TI-2025-00694 Bit Assist <= 1.5.2 - Path Traversal to Authenticated (Subscriber+) Arbitrary File Read via fileID Parameter CVSS 3.1MEDIUM 6.5
TI-2025-00693 Bit Assist <= 1.5.2 - Authenticated (Subscriber+) SQL Injection via id Parameter CVSS 3.1MEDIUM 6.5
TI-2024-12817 Path traversal in bitpressadmin Chat Widget: Floating Customer Support Button for 30+… CVSS 3.1MEDIUM 4.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences