Stored XSS in Live Chat Unlimited 2.8.3

Executive Summary

CVE-2019-25737 is a stored cross-site scripting (XSS) vulnerability in Live Chat Unlimited version 2.8.3. It allows unauthenticated attackers to inject malicious scripts through the chat input field.

Because the input is not properly sanitized, attackers can submit payloads containing script tags and event handlers that execute in the admin area of the application.

This execution can lead to harmful actions such as stealing admin cookies or forcing redirects to malicious websites.

Useful 0 Not Useful 0

Detection Guidance

The vulnerability can be detected by identifying if the Live Chat Unlimited plugin version 2.8.3 is installed on your WordPress site.

One way to detect the presence of the vulnerable plugin is by using the Google Dork: inurl:'wp-content/plugins/screets-lcx'.

Additionally, monitoring the chat input field for suspicious script tags or event handler payloads can help detect exploitation attempts.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows unauthenticated attackers to inject malicious scripts that execute in the admin area, potentially leading to cookie theft or forced redirects to malicious websites.

Such unauthorized access and data theft risks could negatively impact compliance with data protection standards and regulations like GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access and breaches.

However, the provided information does not explicitly discuss compliance implications or specific regulatory impacts.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have serious security impacts if exploited.

• Attackers can steal administrator cookies, potentially gaining unauthorized access to the admin account.
• Attackers can force redirects to malicious websites, which may lead to further compromise or phishing attacks.
• Because the vulnerability is exploitable by unauthenticated users, it increases the risk of attack without needing prior access.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include disabling or removing the vulnerable Live Chat Unlimited plugin version 2.8.3 from your WordPress installation.

Avoid using the chat input field until a patched version is available or the vulnerability is fixed.

Monitor admin sessions for suspicious activity such as unexpected redirects or cookie theft.

Implement web application firewall (WAF) rules to block script injection attempts targeting the chat input field.

Useful 0 Not Useful 0