Historical vulnerability in WP Live Chat Support before 8.0.27

This notice is historical and does not describe a current vulnerability in every version of the plugin.

The vulnerability documented by Sucuri affected versions of WP Live Chat Support before 8.0.27. It allowed the wplc_custom_js option to be changed without authentication and stored JavaScript to be injected, which could be used to redirect visitors. Do not confuse it with CVE-2019-14950, which describes a different XSS in the same plugin through the GDPR page.

If you find an affected version, first preserve the evidence, put the website into maintenance mode and update or reinstall the component from an official source. Check the affected option and the rest of the installation, including users, files, database and logs.

Do not blame a redirect on this plugin just because it is installed: confirm the vulnerable version and look for consistent evidence. If the current component is no longer the same project or has no reliable maintenance, prepare a replacement and test it before removing the plugin.

See also the WordPress security tips.

Version 8.0.27 is cited as the fix for that 2019 flaw, not as a version recommended today. Do not install an old package to reach that number. Identify the current project and its maintenance before updating or replacing it.

If you are investigating a historical copy, keep the value of the option and its context before correcting it. Removing the visible JavaScript does not rule out other changes, nor does it close the access that allowed it to be introduced.