Executive brief
Live Chat Unlimited is a WordPress plugin used to provide real-time customer support chat on websites. A security flaw allows unauthenticated visitors to inject malicious code into the chat window, which then runs in the website administrator's dashboard. This could allow an attacker to hijack administrative sessions, steal sensitive cookies, or redirect staff to fraudulent websites.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in Live Chat Unlimited version 2.8.3 and prior due to insufficient input sanitization in the chat message field. An unauthenticated remote attacker can submit a crafted payload containing malicious JavaScript (e.g., using onerror event handlers) through the public-facing chat interface. Because the plugin stores these messages and renders them in the administrative backend without proper escaping, the script executes in the context of the administrator's browser session. This can lead to session hijacking via cookie theft or unauthorized actions performed on behalf of the administrator. Public exploits (PoCs) are available on Exploit-DB.
Affected products
- Screets Live Chat Unlimited 2.8.3 and earlier
Timeline
- 2019-06-25: disclosed: Initial exploit published on Exploit-DB
- 2026-06-04: advisory: NVD/VulnCheck advisory published