CVE-2024-7816

The Gixaw Chat WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
References
Configurations

Configuration 1 (hide)

cpe:2.3:a:adeelraza:gixaw_chat:*:*:*:*:*:wordpress:*:*

History

26 Sep 2024, 20:23

Type Values Removed Values Added
First Time Adeelraza gixaw Chat
Adeelraza
References () https://wpscan.com/vulnerability/f610c4a5-ccde-4305-93e0-3c6f50c741ee/ - () https://wpscan.com/vulnerability/f610c4a5-ccde-4305-93e0-3c6f50c741ee/ - Exploit, Third Party Advisory
CWE CWE-352
CWE-79
CPE cpe:2.3:a:adeelraza:gixaw_chat:*:*:*:*:*:wordpress:*:*

12 Sep 2024, 14:35

Type Values Removed Values Added
New CVE

Information

Published : 2024-09-12 06:15

Updated : 2024-09-26 20:23


NVD link : CVE-2024-7816

Mitre link : CVE-2024-7816

CVE.ORG link : CVE-2024-7816


JSON object : View

Products Affected

adeelraza

  • gixaw_chat
CWE
CWE-352

Cross-Site Request Forgery (CSRF)

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')