Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat – Bit Assist <= 1.8.4 - Unauthenticated DOM-Based Cross-Site Scripting via Widget Iframe postMessage
- ID
- WPSEC-2026-3037
- Plugin
- Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat – Bit Assist (bit-assist)
- Affected
- all versions before 1.8.5
- Remediation
- Update to 1.8.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-13
- Attack surface
- Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat – Bit Assist on WPSec AttackSurface
- Fix released
- Published
Description
The Bit Assist plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via the chat widget iframe page ('clientDomain' parameter and the 'windowLoaded' postMessage) in all versions up to, and including, 1.8.4. This is due to the widget iframe accepting its API endpoint from any window's postMessage without checking the message origin, then inserting the returned widget data (such as the call-to-action text) into the page with innerHTML. The iframe endpoint also accepted any domain in the 'clientDomain' parameter as an allowed frame ancestor without checking that a widget was configured for it. This makes it possible for unauthenticated attackers to run arbitrary web scripts in the context of the affected site if they can trick a user into visiting a page they control, which frames or opens the widget iframe and points it at attacker-supplied widget data.
References
- https://wpsec.com/vuln/WPSEC-2026-3037/
- https://plugins.svn.wordpress.org/bit-assist/tags/1.8.5/
- https://wordpress.org/plugins/bit-assist/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS