title: JivoChat < 1.3.5.4 - Stored Cross-Site Scripting via CSRF
description: The JivoChat Live Chat WordPress plugin before 1.3.5.4 does not properly check CSRF tokens on POST requests to the plugins admin page, and does not sanitise some parameters, leading to a stored Cross-Site Scripting vulnerability where an attacker can trick a logged in administrator to inject arbitrary javascript.
problem types: CWE-352 Cross-Site Request Forgery (CSRF)
affected:
{
product: JivoChat Live Chat – WP live chat plugin for WordPress
vendor: Unknown
versions:
lessThan: 1.3.5.4, status: affected, version: 1.3.5.4, versionType: custom
}