What the vulnerability does
01Description
A vulnerability classified as problematic was found in ruddernation TinyChat Room Spy Plugin up to 1.2.8 on WordPress. This vulnerability affects the function wp_show_room_spy of the file room-spy.php. The manipulation of the argument room leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 1.2.9 is able to address this issue. The name of the patch is ab72627a963d61fb3bc31018e3855b08dc94a979. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-230392.
Explanation of Vulnerability in Simple Terms
02Summary
The TinyChat Room Spy Plugin contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious scripts into the application. When other users view the affected content, the injected script executes in their browser. This can lead to session hijacking, credential theft, or unauthorized actions performed on behalf of the victim.
What an attacker can do
03Attacker Capabilities
Inject malicious scripts that execute when other users view the affected content.
Potential impact on your site
04Site Impact
Authenticated users can inject scripts affecting other users' sessions and data without admin intervention.
Conditions required to exploit
05Prerequisites
Attacker must be authenticated as a low-privilege user and the victim must view the page containing the injected script.
Key dates
06Disclosure timeline
June 1, 2023
CVE published
August 6, 2024
Record updated
