Vulnerabilities > 3CX > Live Chat > Critical

DATE CVE VULNERABILITY TITLE RISK
2020-03-20 CVE-2019-12498 Missing Authorization vulnerability in 3CX Live Chat
The WP Live Chat Support plugin before 8.0.33 for WordPress accepts certain REST API calls without invoking the wplc_api_permission_check protection mechanism.
network
low complexity
3cx CWE-862
critical
9.8
2019-06-03 CVE-2019-11185 Unrestricted Upload of File with Dangerous Type vulnerability in 3CX Live Chat
The WP Live Chat Support Pro plugin through 8.0.26 for WordPress contains an arbitrary file upload vulnerability.
network
low complexity
3cx CWE-434
critical
9.8
2018-07-02 CVE-2018-12426 Unrestricted Upload of File with Dangerous Type vulnerability in 3CX Live Chat
The WP Live Chat Support Pro plugin before 8.0.07 for WordPress is vulnerable to unauthenticated Remote Code Execution due to client-side validation of allowed file types, as demonstrated by a v1/remote_upload request with a .php filename and the image/jpeg content type.
network
low complexity
3cx CWE-434
critical
9.8