Researchers hackers are exploiting a vulnerability, for which an update was recently released, that redirects users to malicious sites or displays misleading pop-ups.
The vulnerability was discovered in WP Live Chat Support, a WordPress chat plugin, and was patched two weeks ago. WP Live Chat Support allows site visitors to have live chats with site representatives and currently has 50,000 active installations. The cross-site scripting vulnerability, found in the plugin, allows an attacker to inject malicious JavaScript into sites that use the plugin.
Security researchers from Zscaler's ThreatLabZ reported that hackers have identified sites using the outdated version of WP Live Chat Support, redirecting users to malicious sites or displaying unwanted pop-ups.
At the moment, the number of attacks is not very high. However, the attacks are enough to cause concern.
The researchers said that hackers are constantly looking for new vulnerabilities in popular content management services, such as WordPress and Drupal, as well as in plugins, which are found on many websites. When vulnerabilities exist in plugins, hackers can exploit them and inject malicious code into sites, putting unsuspecting users at risk.
The vulnerability, found in the plugin, allows anyone visiting the site to update the plugin's settings. This allows hackers to inject malicious JavaScript wherever the Live Chat Support icon appears.
The research team published a list of 47 sites that were affected by the vulnerability in the plugin.
