Unrated severityNVD Advisory· Published Feb 20, 2015· Updated Jun 17, 2026
CVE-2015-2039
CVE-2015-2039
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in the Acobot Live Chat & Contact Form plugin 2.0 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings or (2) conduct cross-site scripting (XSS) attacks via the acobot_token parameter in the acobot page to wp-admin/options-general.php.
Affected products
2- cpe:2.3:a:acobot_live_chat_\&_contact_form_project:acobot_live_chat_\&_contact_form:2.0:*:*:*:*:wordpress:*:*
- Range: =2.0
Patches
Vulnerability mechanics
References
3News mentions
0No linked articles in our index yet.