CVE-2024-0898

The Chat Bubble – Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

• CWE-79
• CWE-79

• https://wordpress.org/plugins/chat-bubble/Product
• https://www.wordfence.com/threat-intel/vulnerabilities/id/a56772fd-f77f-4ba5-b5c4-79ac8204b599?source=cveThird Party Advisory
• https://wordpress.org/plugins/chat-bubble/Product
• https://www.wordfence.com/threat-intel/vulnerabilities/id/a56772fd-f77f-4ba5-b5c4-79ac8204b599?source=cveThird Party Advisory

Published

Mar 13, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-0891A vulnerability was found in hongmaple octopus 1.0. It has b…5.4
• CVE-2024-0892The Schema App Structured Data plugin for WordPress is vulne…4.3
• CVE-2024-0893The Schema App Structured Data plugin for WordPress is vulne…4.3
• CVE-2024-0895The PDF Flipbook, 3D Flipbook – DearFlip plugin for WordPres…5.4
• CVE-2024-0896The Beaver Builder – WordPress Page Builder plugin for WordP…5.4
• CVE-2024-0897The Beaver Builder – WordPress Page Builder plugin for WordP…5.4
• CVE-2024-0899The s2Member – Best Membership Plugin for All Kinds of Membe…5.3
• CVE-2024-0900The Elespare – Build Your Blog, News & Magazine Websites wit…4.3
• CVE-2024-0901Remotely executed SEGV and out of bounds read allows malicio…9.1
• CVE-2024-0902The Fancy Product Designer WordPress plugin before 6.1.81 do…4.8
• CVE-2024-0903The User Feedback – Create Interactive Feedback Form, User S…6.1
• CVE-2024-0904The Fancy Product Designer WordPress plugin before 6.1.81 do…5.9