Description
The Crisp Live Chat WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation via the crisp_plugin_settings_page function found in the ~/crisp.php file, which made it possible for attackers to inject arbitrary web scripts in versions up to, and including 0.31.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Crisp Live Chat | Crisp Live Chat | 0.31 – ≤ 0.31 | — |