CVE-2022-3415

6.1 mediumEPSS 0.6%

Medium (6.1) in bluecoral chat bubble. EPSS 0.6% chance of exploitation in the next 30 days.

The Chat Bubble WordPress plugin before 2.3 does not sanitise and escape some contact parameters, which could allow unauthenticated attackers to set Stored Cross-Site Scripting payloads in them, which will trigger when an admin view the related contact message

Severity

CVSS 3.1

6.1 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 47% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2022-11-14
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

bluecoral:chat_bubble

References

https://wpscan.com/vulnerability/012c5b64-ef76-4539-afd8-40f6c329ae88
https://wpscan.com/vulnerability/012c5b64-ef76-4539-afd8-40f6c329ae88

Check your stack JSON