blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2022-0642

MEDIUM 5.4 CVSS 3.1
Published
May 30, 2022
Last modified
June 17, 2026
NVD status
Modified
Reported by
contact@wpscan.com
Weakness
CWE-352
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Description

The JivoChat Live Chat WordPress plugin before 1.3.5.4 does not properly check CSRF tokens on POST requests to the plugins admin page, and does not sanitise some parameters, leading to a stored Cross-Site Scripting vulnerability where an attacker can trick a logged in administrator to inject arbitrary javascript.

Affected WordPress components

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • Unknown JivoChat Live Chat – WP live chat plugin for WordPress — From 1.3.5.4 (including) to 1.3.5.4 (excluding)
  • jivochat jivochat — Before 1.3.5.4

References

  • wpscan.com https://wpscan.com/vulnerability/099cf9b4-0b3a-43c6-8ca9-7c2d50f86425 Exploit, Third Party Advisory
  • nvd.nist.gov Official NVD record