CVE-2019-25737
Stored XSS in Live Chat Unlimited 2.8.3
Publication date: 2026-06-04
Last updated on: 2026-06-04
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| screets | live_chat_unlimited | to 2.8.3 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows unauthenticated attackers to inject malicious scripts that execute in the admin area, potentially leading to cookie theft or forced redirects to malicious websites.
Such unauthorized access and data theft risks could negatively impact compliance with data protection standards and regulations like GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access and breaches.
However, the provided information does not explicitly discuss compliance implications or specific regulatory impacts.
Can you explain this vulnerability to me?
CVE-2019-25737 is a stored cross-site scripting (XSS) vulnerability in Live Chat Unlimited version 2.8.3. It allows unauthenticated attackers to inject malicious scripts through the chat input field.
Because the input is not properly sanitized, attackers can submit payloads containing script tags and event handlers that execute in the admin area of the application.
This execution can lead to harmful actions such as stealing admin cookies or forcing redirects to malicious websites.
How can this vulnerability impact me? :
This vulnerability can have serious security impacts if exploited.
- Attackers can steal administrator cookies, potentially gaining unauthorized access to the admin account.
- Attackers can force redirects to malicious websites, which may lead to further compromise or phishing attacks.
- Because the vulnerability is exploitable by unauthenticated users, it increases the risk of attack without needing prior access.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include disabling or removing the vulnerable Live Chat Unlimited plugin version 2.8.3 from your WordPress installation.
Avoid using the chat input field until a patched version is available or the vulnerability is fixed.
Monitor admin sessions for suspicious activity such as unexpected redirects or cookie theft.
Implement web application firewall (WAF) rules to block script injection attempts targeting the chat input field.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
The vulnerability can be detected by identifying if the Live Chat Unlimited plugin version 2.8.3 is installed on your WordPress site.
One way to detect the presence of the vulnerable plugin is by using the Google Dork: inurl:'wp-content/plugins/screets-lcx'.
Additionally, monitoring the chat input field for suspicious script tags or event handler payloads can help detect exploitation attempts.