CVE-2024-49281: ninja team click to chat – wp support all-in-one floating widget OS Command Injection

Vulnerability summary

CVE-2024-49281 is a medium (CVSS 6.5) OS Command Injection vulnerability in ninja team click to chat – wp support all-in-one floating widget. EPSS estimates a 0.55% chance of exploitation in the next 30 days, higher than 45.1% of scored vulnerabilities.

Timeline

1. 17-10-2024
   PublishedVulnerability first disclosed.
2. 28-04-2026
   Last modifiedVulnerability information updated.

Description

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Ninja Team Click to Chat – WP Support All-in-One Floating Widget support-chat allows Stored XSS.This issue affects Click to Chat – WP Support All-in-One Floating Widget: from n/a through <= 2.3.3.

• CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
• CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.