Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

6 records

Vendor: ninjateam Component: Wp Chat App Clear all filters
TI-2024-09757 CVE-2024-10533 · GHSA-8qcp-625c-54ww

WP Chat App <= 3.6.8 - Missing Authorization to Authenticated (Subscriber+) Filebird Plugin Installation

Priority LOW 20

The WP Chat App plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the ajax_install_plugin() function in all versions up to, and including, 3.6.8.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0046 Published 2024-11-16 No fix listed CWE-862
TI-2024-04339 CVE-2024-4664 · GHSA-fg8w-72jj-fqx9

WP Chat App < 3.6.5 - Admin+ Stored XSS

Priority MEDIUM 55

The WP Chat App WordPress plugin before 3.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admins to perform Cross-Site Scripting attacks even when unfiltered_html is…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00373 Published 2024-06-27 Fixed in 3.6.5 CWE-79
TI-2024-02647 CVE-2024-2837 · GHSA-qx35-w84c-98jc

WP Chat App < 3.6.4 - Admin+ Stored XSS

Priority MEDIUM 58

The WP Chat App WordPress plugin before 3.6.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admins to perform Cross-Site Scripting attacks even when unfiltered_html is…

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00522 Published 2024-04-26 Fixed in 3.6.4 CWE-79
TI-2024-02336 CVE-2024-2513 · GHSA-658g-8whg-f6jx

WP Chat App <= 3.6.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via Block Image Attribute

Priority LOW 28

The WP Chat App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'imageAlt' block attribute in all versions up to, and including, 3.6.2 due to insufficient input sanitization and output escaping…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.0036 Published 2024-04-09 No fix listed CWE-20
TI-2024-01638 CVE-2024-1761 · GHSA-vqc4-wfj3-2mr7

WP Chat App <= 3.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes

Priority LOW 29

The WP Chat App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widget/block in all versions up to, and including, 3.6.1 due to insufficient input sanitization and output escaping on us…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00371 Published 2024-03-07 No fix listed CWE-79
TI-2023-28028 CVE-2023-51370 · GHSA-3rgw-269v-xpvx

WordPress WP Chat App Plugin <= 3.4.4 is vulnerable to Cross Site Scripting (XSS)

Priority LOW 26

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NinjaTeam WP Chat App allows Stored XSS.This issue affects WP Chat App: from n/a through 3.4.4.

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00336 Published 2024-02-12 No fix listed CWE-79