WP-LiveChat

Hi there,

We’re working hard towards hardening our plugin security. Existing users can update to the 8.0.29 version which contains a fix against this vulnerability. A fully updated version of the plugin will become available soon.

we’re also working on releasing a user workaround for those who were affected. We’re hoping to have something new in the next few days.

The so called PRO is deprecated. There is no PRO anymore. We’ve deprecated it entirely and merged it’s functionality into 1 fully functional free plugin that’s only hosted here on wordpress.org.

If you have installed the so called PRO, please uninstall it entirely and use the latest .29 version instead.

We’ve taken an entirely new direction over the past 1-2 months now, have hired an entirely new team of developers for the plugin and plan to work on making the plugin much better and reliable. The ‘Pro’ deprecation and moving everything to be completely free was basically our first step towards all this. The next step is to improve the reliability and general functionality of the plugin. Our new team also includes a security auditing engineer who will be checking everything extremely thoroughly.

Version 8.0.27 has a vulnerability on GDPR page: if admins click a malicious url while logged in, there’s a chance that some external malicious JS file is added to the custom script section.

In order to patch yourself against the vulnerability: Uninstall version 8.0.27 and install version 8.0.29 which we will be committing shortly. This version fixes the vulnerability.

Also check the menu Settings / Custom Scripts and clean up the unwanted code if any is present.

• This reply was modified 7 years ago by Andrew Nevins.
• This reply was modified 7 years ago by WP-LiveChat.

Thank you for reporting this.

We’ve identified this issue as well and hope to fix it in the next release of the plugin.

We recently made a new release both for the plugin and the backend. Could you clear your cache as follows and try again?

1) Press F12 on the affected page.
2) While the development console is visible, using your mouse cursor click and hold the “Refresh” button on the top left.
3) Three options will appear, select “Empty cache and hard reload”.

Try again and see what happens. If the issue persists, open the F12 development console and go to the “Console” tab. Reload the page 1 more time and let us know if you see anything more beyond the error above. Do you see any info shown like the server you’re trying to connect to?

Hi Ammar,

You will need to investigate this on your end by checking the firewall logs to identify which endpoints (or protocols) might be blocked. You could also check if any errors are being produced in the developer tools of the browser (F12) when trying to connect, in order to identify where it could be failing.

Hi @ammaratrache1980 ,

Which firewall are you referring to? The website’s firewall (for instance wordfence) or a network firewall?

What error do you get? (if any)