CVE-2021-43353: Crisp

High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days.

The Crisp Live Chat WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation via the crisp_plugin_settings_page function found in the ~/crisp.php file, which made it possible for attackers to inject arbitrary web scripts in versions up to, and including 0.31.

Affected products

• Crisp Crisp: before 0.32 (fixed in 0.32)

Published 2022-01-18. Last modified 2026-06-17.