Wise Chat
Monthly
Unauthenticated PHP Object Injection in Wise Chat WordPress plugin versions up to and including 3.4 allows a remote attacker to achieve high-impact compromise of confidentiality, integrity, and availability by passing crafted serialized data to an unprotected deserialization point. Exploitation requires a viable POP gadget chain within the target WordPress environment, keeping the practical bar elevated despite requiring no credentials. No KEV listing or public POC has been identified at time of analysis.
Stored Cross-Site Scripting in the Wise Chat WordPress plugin (versions <= 3.4) allows authenticated contributors to inject persistent malicious JavaScript that executes in the browser context of other site users, including administrators. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C) confirms this is network-exploitable at low complexity, requiring only contributor-level WordPress access and a victim loading the poisoned chat interface. No public exploit code or active exploitation has been identified at time of analysis.
The Wise Chat plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.3 via the 'uploads' directory. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Cross-Site Request Forgery (CSRF) vulnerability in Kainex Wise Chat.1.3. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Wise Chat plugin before 2.7 for WordPress mishandles external links because rendering/filters/post/WiseChatLinksPostFilter.php omits noopener and noreferrer. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Unauthenticated PHP Object Injection in Wise Chat WordPress plugin versions up to and including 3.4 allows a remote attacker to achieve high-impact compromise of confidentiality, integrity, and availability by passing crafted serialized data to an unprotected deserialization point. Exploitation requires a viable POP gadget chain within the target WordPress environment, keeping the practical bar elevated despite requiring no credentials. No KEV listing or public POC has been identified at time of analysis.
Stored Cross-Site Scripting in the Wise Chat WordPress plugin (versions <= 3.4) allows authenticated contributors to inject persistent malicious JavaScript that executes in the browser context of other site users, including administrators. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C) confirms this is network-exploitable at low complexity, requiring only contributor-level WordPress access and a victim loading the poisoned chat interface. No public exploit code or active exploitation has been identified at time of analysis.
The Wise Chat plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.3 via the 'uploads' directory. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Cross-Site Request Forgery (CSRF) vulnerability in Kainex Wise Chat.1.3. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Wise Chat plugin before 2.7 for WordPress mishandles external links because rendering/filters/post/WiseChatLinksPostFilter.php omits noopener and noreferrer. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.