CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ginger Plugins Sticky Chat Widget: Click to chat, SMS, Email, Messages, Call Button, Live Chat and Live Support Button allows Stored XSS.This issue affects Sticky Chat Widget: Click to chat, SMS, Email, Messages, Call Button, Live Chat and Live Support Button: from n/a through 1.1.8.
Explanation of Vulnerability in Simple Terms
The Sticky Chat Widget plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in versions up to 1.1.8. An authenticated user with high privileges can inject malicious JavaScript that executes in the browsers of other site visitors. The vulnerability requires user interaction to trigger and affects the integrity and confidentiality of the site.
What an attacker can do
Inject malicious JavaScript that runs in visitors' browsers and steals data or performs actions on their behalf.
Potential impact on your site
A compromised admin account could inject malicious code affecting all site visitors, potentially stealing credentials or redirecting users.
Conditions required to exploit
Attacker must have high-level admin or editor access to the WordPress site, and a visitor must view the affected page.
Key dates
External resources
Related vulnerabilities
