wp-plugin : activehelper-livehelp – A3-Cross-Site Scripting (XSS)


Plugin Details


Plugin Name : activehelper-livehelp


Effected Version : 3.1.0 (and most probably lower version's if any)

Vulnerability : A3-Cross-Site Scripting (XSS)
Identified by : Prajal Kulkarni



Technical Details


Minimum Level of Access Required : Unauthenticated


PoC - (Proof of Concept) :


Vulnerable Parameters : MESSAGE, EMAIL, NAME


Disclosure Timeline


Vendor Contacted : 2014-01-21

Plugin Status : Updated on 2014-02-10
Public Disclosure : May 28, 2014
CVE Number : CVE-2014-4513

Plugin Description :
WordPress Live Chat Plugin is the most affordable and scalable Live Chat. ActiveHelper LiveHelp Live Chat System is perfect for small and medium WordPress sites. Answer Live chats from any location, Desktop and mobile are included, Windows and Mac, IOS and Android too.

Monitor in real time your website visitors. Know how many visitors are in the website, who referred, where are from, what keywords we reused to find the website and the visitors navigation history. Know decisive information of your website visitors patterns, conversations and agents service.

Geo Location based on IP to location for the visitors on your website. See the visitors hometown map. Run the Live Help on your web server having 100% control over your data and many domains that you have.

The ActiveHelper LiveHelp Server is UTF-8 multi language. The Live Chat system is translated to English, Spanish, German, Portuguese, Italian, French, Czech, Swedish, Norwegian, Turkey, Farsi, Greek, Hebrew, Serbo-Croatian, Russian , Hungarian ,Dutch, Finnish, Danish, Traditional Chinese, Simplified Chinese , Arab , Polish , Bulgarian , Slovak , Lithuanian ,  Croatian , Indonesian , Romanian, Slovenian, Estonian and Latvian.

= Main Features =

* Unlimited Operators
* Unlimited Departments
* Unlimited Domains
* Multi Language Support
* Full UTF-8 Support
* SSL Support
* Chat Re-branding
* Image for each agent
* Agent to Agent chat
* Multi Language WordPress admin panel
* Real-time Chats
* Multiple Chat Requests
* Auto Save Transcripts
* Capture Visitor Data
* Chat Queue Line
* Offline Messages
* Disable chat module in Offline mode
* Record Offline Messages
* Send Transcription to the Visitor
* Ratings
* Transfer Chats
* Visitors Tracking
* Visitors Navigation History
* Proactive Chat Invitations
* Proactive Messages
* Auto start invitation
* Disable Invitation
* Redirect URL offline form
* Website Push
* Typing status notifications
* Pre typed Responses
* Send Links / Images / JavaScript
* Sound & Visual Alerts
* Smiles Images
* Operator Rating
* Summarize System activity
* Support Statistics
* Geo Location based on IP
* Google Analytic integration.
* Online/Offline status images
* Proxy support
* Multi Language Images
* 25 Language Translations.
* Agent spellchecker
* Support Panel desktop for Windows and MAC
* Support panel mobile for your iPhone/ipad
* Support panel mobile for your Android phone and tablet
* Customizable Look & Feel
* Skin Support

Try Free

We offer a 30 days free trial.

More Information

Visit the ActiveHelper LiveHelp website for more information about ActiveHelper LiveHelp.

Support Panel Desktop

Download the Support Panel Multi Platform Console, the agent app is available in the follow link for Windows and MAC: Download Area.

Support Panel Mobile

Download the Support Panel Mobile for Iphone and Ipad, the agent app is available in the follow link via Itunes: Itunes download area. Download the Support Panel Mobile for Android, the agent app is available in the follow link via Google Play: Google Play download area.

Support Panel Multi Platform Console Guide

Visit the follow link to see the user guide.

Leave a Reply

Your email address will not be published. Required fields are marked *