High severity8.8NVD Advisory· Published Jan 18, 2022· Updated Jun 17, 2026
CVE-2021-43353
CVE-2021-43353
Description
The Crisp Live Chat WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation via the crisp_plugin_settings_page function found in the ~/crisp.php file, which made it possible for attackers to inject arbitrary web scripts in versions up to, and including 0.31.
Affected products
2- Range: <=0.31
- Range: 0.31
Patches
Vulnerability mechanics
References
2- plugins.trac.wordpress.org/changesetnvdIssue TrackingPatchThird Party Advisory
- www.wordfence.com/vulnerability-advisories/nvdThird Party Advisory
News mentions
0No linked articles in our index yet.