Vulnerability · Published Nov 14, 2022 · Assigned by WPScan
CVE-2022-3415Chat Bubble < 2.3 - Unauthenticated Stored Cross-Site Scripting
Medium 6.1
In plain English
A medium-severity cross-site scripting in Chat Bubble – Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).
Severity (CVSS 3.1)6.1Medium
Exploit odds (30 days)0.6%top 52.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The Chat Bubble WordPress plugin before 2.3 does not sanitise and escape some contact parameters, which could allow unauthenticated attackers to set Stored Cross-Site Scripting payloads in them, which will trigger when an admin view the related contact message
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Chat Bubble – Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back | 2.3 – before 2.3 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N