CVE-2021-43353

Name of the Vulnerable Software and Affected Versions Crisp Live Chat WordPress plugin versions up to, and including 0.31

Description The issue is related to Cross-Site Request Forgery due to missing nonce validation via the crisp plugin settings page function found in the ~/crisp.php file. This made it possible for attackers to inject arbitrary web scripts.

Recommendations For versions up to, and including 0.31, update to a version that includes the necessary nonce validation to prevent Cross-Site Request Forgery attacks. As a temporary workaround, consider disabling the crisp plugin settings page function until a patch is available.