CVE-2021-43353 HIGH

CVE-2021-43353: Crisp Live Chat <= 0.31 Cross-Site Request Forgery to Stored Cross-Site Scripting

Vendor Crisp Live Chat
Product Crisp Live Chat
Weakness CWE-352 · CSRF
Published January 18, 2022
Last update January 31, 2025
View on NVD All CVEs

CVSS base score

8.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

The Crisp Live Chat WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation via the crisp_plugin_settings_page function found in the ~/crisp.php file, which made it possible for attackers to inject arbitrary web scripts in versions up to, and including 0.31.

Key dates

02Disclosure timeline

January 18, 2022 CVE published
January 31, 2025 Record updated