CVE-2018-11105

Name: CVE-2018-11105
Creator: NVD / NIST
Published: 2018-05-15T15:29:00.21+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 1.10%

Last modified Jun 17, 2026

CVE-2018-11105 is a vulnerability of currently unknown severity. There is stored cross site scripting in the wp-live-chat-support plugin before 8.0.08 for WordPress via the "name" (aka wplc_name) and "email" (aka wplc_email) input fields to wp-json/wp_live_chat_support/v1/start_chat whenever a malicious attacker would initiate a new chat with an administrator. NOTE: this issue exists because of an incomplete fix for CVE-2018-9864.. EPSS estimates a 1.10% chance of exploitation in the next 30 days.

Description

There is stored cross site scripting in the wp-live-chat-support plugin before 8.0.08 for WordPress via the "name" (aka wplc_name) and "email" (aka wplc_email) input fields to wp-json/wp_live_chat_support/v1/start_chat whenever a malicious attacker would initiate a new chat with an administrator. NOTE: this issue exists because of an incomplete fix for CVE-2018-9864.

Metrics

EPSS Probability

1.10%

61.4th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-79

Affected Software

Vendor	Product	Versions
3cx	Live Chat	< 8.0.08

References

https://github.com/RiieCco/write-ups/tree/master/CVE-2018-11105Exploit, Third Party Advisory
https://wordpress.org/plugins/wp-live-chat-support/#developersPatch, Release Notes
https://github.com/RiieCco/write-ups/tree/master/CVE-2018-11105Exploit, Third Party Advisory
https://wordpress.org/plugins/wp-live-chat-support/#developersPatch, Release Notes

Timeline

Published: May 15, 2018
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2018-11105?

How severe is CVE-2018-11105?

Severity scoring for CVE-2018-11105 is pending analysis. The EPSS model estimates a 1.10% probability of exploitation in the next 30 days.

How do I fix CVE-2018-11105?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2018-11105?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST