Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

6 records

Vendor: premio Component: Chaty Clear all filters
TI-2023-25869 CVE-2023-47759 · GHSA-r55f-v7qm-xxpg

WordPress Chaty plugin <= 3.1.2 - Cross Site Scripting (XSS) vulnerability

Priority LOW 27

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Premio Chaty chaty allows DOM-Based XSS.This issue affects Chaty: from n/a through <= 3.1.2.

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00398 Published 2023-11-22 No fix listed CWE-79
TI-2023-03041 CVE-2023-3245 · GHSA-vrpj-wv5c-r9r4

Floating Chat Widget < 3.1.2 - Admin+ Stored Cross-Site Scripting

Priority MEDIUM 55

The Floating Chat Widget WordPress plugin before 3.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00455 Published 2023-07-17 Fixed in 3.1.2 CWE-79
TI-2022-03536 CVE-2022-3858 · GHSA-gx37-5pp8-f39c

Chaty < 3.0.3 - Admin+ SQLi

Priority HIGH 67

The Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line, WeChat, Email, SMS, Call Button WordPress plugin before 3.0.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leadi…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01062 Published 2022-12-05 Fixed in 3.0.3
TI-2021-07294 CVE-2021-25016 · GHSA-5jw4-xcrp-43f8

Chaty < 2.8.3 - Reflected Cross-Site Scripting

Priority LOW 31

The Chaty WordPress plugin before 2.8.3 and Chaty Pro WordPress plugin before 2.8.2 do not sanitise and escape the search parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scri…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01846 Published 2022-01-03 Fixed in 2.8.3, 2.8.2 CWE-79