6.1
Medium
CVE-2022-3415 The Chat Bubble WordPress plugin before 2.3 does not sanitise and escape some contact parameters, which could allow…
Description
The Chat Bubble WordPress plugin before 2.3 does not sanitise and escape some contact parameters, which could allow unauthenticated attackers to set Stored Cross-Site Scripting payloads in them, which will trigger when an admin view the related contact message
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Chat Bubble – Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back 2.3 | earliest → < 2.3 | 2.3 |