CVE-2019-20212

Vulnerability

A persistent cross-site scripting (XSS) vulnerability exists in the chat widget and dashboard chat message form of three CTHthemes WordPress themes: CityBook before version 2.3.4, TownHub before version 1.0.6, and EasyBook before version 1.2.2 [1][2][3]. The chat functionality does not sanitize user input in the reply_text parameter, allowing the injection of arbitrary HTML and JavaScript [1]. The vulnerability is reachable from the chat widget on the bottom-right corner of any page or from the /dashboard/ chat interface [1].

Exploitation

An unauthenticated attacker can send a crafted POST request to /wp-admin/admin-ajax.php with the action parameter set to the theme-specific chat reply action (e.g., easybook_addons_chat_reply) and include a malicious payload in the reply_text field. A valid nonce (_nonce) and a chat conversation ID (cid) are required, but these can be obtained by initiating a chat session as a regular visitor [1][2]. The injected payload is then stored and executed in the browser of any user or administrator who views the chat history [1][2][3].

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser. This can lead to cookie theft (session hijacking), forced redirection to malicious websites, or defacement of the chat interface. If an administrator views the malicious chat message, the attacker could steal admin cookies and gain full administrative access to the WordPress site [1][2][3].

Mitigation

CTHthemes has released patched versions: CityBook 2.3.4, TownHub 1.0.6, and EasyBook 1.2.2 [1][2][3]. Users should update to these fixed versions immediately. No workaround is available for unpatched installations. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog as of the publication date.