Lucene search

PatchstackCVE-2023-51361

HistoryDec 29, 2023 - 11:15 a.m.

CVE-2023-51361

2023-12-2911:15:09

CWE-79

Patchstack

web.nvd.nist.gov

cve-2023-51361

cross-site scripting

xss

ginger plugins

sticky chat widget

web page generation

vulnerability

nvd

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

AI Score

5.3

Confidence

High

EPSS

Percentile

14.0%

JSON

Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Ginger Plugins Sticky Chat Widget: Click to chat, SMS, Email, Messages, Call Button, Live Chat and Live Support Button allows Stored XSS.This issue affects Sticky Chat Widget: Click to chat, SMS, Email, Messages, Call Button, Live Chat and Live Support Button: from n/a through 1.1.8.

Affected configurations

Nvd

Vulners

Node

gingerpluginssticky_chat_widgetRange≤1.1.8wordpress

VendorProductVersionCPE
gingerpluginssticky_chat_widget*cpe:2.3:a:gingerplugins:sticky_chat_widget:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
gingerplugins	sticky_chat_widget	*	cpe:2.3:a:gingerplugins:sticky_chat_widget::::::wordpress::*

CNA Affected

[
  {
    "collectionURL": "https://wordpress.org/plugins",
    "defaultStatus": "unaffected",
    "packageName": "sticky-chat-widget",
    "product": "Sticky Chat Widget: Click to chat, SMS, Email, Messages, Call Button, Live Chat and Live Support Button",
    "vendor": "Ginger Plugins",
    "versions": [
      {
        "changes": [
          {
            "at": "1.1.9",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "1.1.8",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  }
]

References

patchstack.com/database/vulnerability/sticky-chat-widget/wordpress-sticky-chat-widget-plugin-1-1-8-cross-site-scripting-xss-vulnerability?_s_id=cve