CVE-2024-4149
📋 TL;DR
This vulnerability in the Floating Chat Widget WordPress plugin allows administrators to inject malicious scripts into plugin settings, which then execute in other users' browsers. It affects WordPress sites using plugin versions before 3.2.3, particularly in multisite configurations where unfiltered_html is restricted.
💻 Affected Systems
- Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button WordPress plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Administrator account compromise leads to site takeover, credential theft from all users, or malware distribution to visitors.
Likely Case
Privileged admin user injects malicious JavaScript that steals session cookies or redirects users to phishing sites.
If Mitigated
Limited to admin users only, with minimal impact if proper user access controls and monitoring are in place.
🎯 Exploit Status
Exploitation requires administrative privileges. Attack vector is through plugin settings interface.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.2.3
Vendor Advisory: https://wpscan.com/vulnerability/0256ec2a-f1a9-4110-9978-ee88f9e24237/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Floating Chat Widget' plugin. 4. Click 'Update Now' if update is available. 5. Alternatively, download version 3.2.3+ from WordPress repository and replace existing files.
🔧 Temporary Workarounds
Disable Plugin
allTemporarily disable the vulnerable plugin until patching is possible.
wp plugin deactivate floating-chat-widget
Restrict Admin Access
allLimit administrative accounts to trusted users only and implement multi-factor authentication.
🧯 If You Can't Patch
- Remove admin privileges from untrusted users immediately.
- Implement Content Security Policy (CSP) headers to restrict script execution.
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel → Plugins → Floating Chat Widget → Version number. If version is below 3.2.3, you are vulnerable.Check Version:
wp plugin get floating-chat-widget --field=versionVerify Fix Applied:
Confirm plugin version is 3.2.3 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual plugin setting modifications by admin users
- JavaScript injection patterns in plugin option values
Network Indicators:
- Unexpected external script loads from your domain
- Suspicious outbound connections following page loads
SIEM Query:
source="wordpress" AND (event="plugin_updated" OR event="option_updated") AND plugin="floating-chat-widget"