CVE-2021-43353: Crisp Live Chat <= 0.31 Cross-Site Request Forgery to Stored Cross-Site Scripting

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-01-18 · updated 2026-06-17
Weakness: CWE-352

Description

The Crisp Live Chat WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation via the crisp_plugin_settings_page function found in the ~/crisp.php file, which made it possible for attackers to inject arbitrary web scripts in versions up to, and including 0.31.

Affected products

Crisp: before 0.32 — fixed in 0.32

How to fix

Upgrade to a fixed version: Crisp 0.32. Check the vendor advisory for mitigations.

References

https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2643954%40crisp&new=2643954%40crisp&sfp_email=&sfph_mail=
https://www.wordfence.com/vulnerability-advisories/#CVE-2021-43353
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2643954%40crisp&new=2643954%40crisp&sfp_email=&sfph_mail=
https://www.wordfence.com/vulnerability-advisories/#CVE-2021-43353

Get alerted when CVE-2021-43353 or the next vulnerability affects your stack