wp-plugin : avchat-3 – A3-Cross-Site Scripting (XSS)

 

Plugin Details

 

Plugin Name : avchat-3

 

Effected Version : 1.4.1 (and most probably lower version's if any)

 
Vulnerability : A3-Cross-Site Scripting (XSS)
 
Identified by : Anant Shrivastava

 

 

Technical Details

 

Minimum Level of Access Required : Unauthenticated

 

PoC - (Proof of Concept) :

 
http://localhost/wp-content/plugins/avchat-3/index_popup.php?movie_param=</script><script>alert(document.cookie)</script>&FB_appId=FB_appId"><script>alert(document.cookie)</script>&

 

Vulnerable Parameter : FB_appId, movie_param

 

Type of XSS : Reflected

 

Fixed Version : 1.4.2

 

Trac Changelog : https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=833938%40avchat-3&old=820994%40avchat-3&sfp_email=&sfph_mail=

 

Disclosure Timeline

 

Vendor Contacted : 2014-01-04

 
Plugin Status : Updated on 2014-01-06
 
Public Disclosure : July 7, 2014
 
CVE Number : Not assigned yet

 
Plugin Description :
 
The AVChat Video Chat Plugin Standard handles the basic integration between AVChat and your WordPress website.

 ★★★★ 2000+ clients already use AVChat on their WordPress websites ★★★★

 ★★★★ 5 STAR RATING on wordpress.org, check out the reviews below: ★★★★

 * "What a great experience, from discovering a plugin that did exactly what I needed, to a team that goes way above and beyond helping me get set up" by *mindbodyseries*
 * "Wow, I'd like to give a five-star to AVChat" by *icndream*
 * "The service is second to none" by  *pssawhney*

Check out all the WP reviews at http://wordpress.org/support/view/plugin-reviews/avchat-3

AVChat is a highly flexible video chat software that can be installed on your website. It supports, rooms, moderators, private messages, public and private video chat, etc. . For a complete list of features check out the AVChat features page. For pricing check out the AVChat pricing page.

This plugin will take care of :

* username integration (users logged in the WordPress web site will not have to login again in the video chat )
* permissions & features for each user role (you can change them from your WordPress admin area)
* BuddyPress compatibility: BuddyPress avatars are automatically recognized and added to users profiles in the video chat (user profiles can be accessed directly from AVChat also)
* enter chat with Facebook account for visitors
* iPhone/iPad/Android detection: the plugin will detect if the member is on a mobile device and deliver the mobile version of AVChat

Other features include :

* simple install: it installs as any other WP plugin
* compatible with SEO friendly URL's in WordPress
* customizable design: the chat looks and feel can be changed to fit with your existing WordPress theme

The above features are part of the **Standard** edition of this plugin which you can download for free from this page.

> #### The PRO version
> With the PRO version you get more than 28 new configuration options and permissions that you can customize for each user role, **multisite support**, better BuddyPress integration, a free installation and 3 months of full support and updates, and of course, our gratitude for helping us sustain this plugin and for the countless late-night hours that have been poured into it's development.
> **Find out more about the PRO version at http://avchat.net/integrations/wordpress**.


The AVChat Video Chat Plugin Standard for WordPress is licensed under GPL v2. See the full text of the GPL v2 license in license.txt.

> #***"Our users are very happy with the chat system and we see that more and more are using it every day... outstanding email support... quick to reply and always extremely helpful...easy to setup and reliable chat system"*** -
Mike Johnsen.

★★★TOP 5 REASONS WHY THIS IS THE BEST PLUGIN FOR YOUR WEBSITE:★★★

① Increase members engagement

② Increase time spent on site 4X

③ Increase premium ad space (below and above the chat)

④ Increase membership revenue

⑤ Hassle free video chat for your members

Leave a Reply

Your email address will not be published. Required fields are marked *