CVE-2019-25737
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
Live Chat Unlimited version 2.8.3 contains a stored cross-site scripting (XSS) vulnerability that allows unauthenticated attackers to inject malicious scripts through the chat input field. Attackers can submit payloads containing script tags and event handlers that execute in the admin area.
Risk Assessment
This vulnerability could lead to cookie theft or forced redirects to malicious websites, posing a serious threat to the organization's data security.
Recommendation
It is recommended to update Live Chat Unlimited to the latest version to mitigate this vulnerability and implement additional security measures such as input validation.
Original NVD description (English source)
Live Chat Unlimited 2.8.3 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts through the chat input field. Attackers can submit payloads containing script tags and event handlers that execute in the admin area, enabling cookie theft or forced redirects to malicious websites.