Hive Support | Ai Powered Help Desk, Live Chat And Chatbot
Approved changes feed: RSS · Atom
cpe:2.3:a:hivesupport:hive_support_|_ai-powered_help_desk,_live_chat_and_chatbot:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Hivesupport (4a7271dd-cd86-567d-a84a-a86ad1edb376) |
|---|---|
| Product | Hive Support | Ai Powered Help Desk, Live Chat And Chatbot (a2b2a4e0-94c9-5b19-accb-62b99b5bd9d6) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-5019 |
vulnerable | 2026-06-08 07:35:23.921281 |
Hive Support <= 1.2.5 - Cross-Site Request Forgery via hs_update_ai_chat_settings Function
MEDIUM (5.4)
The Hive Support | AI-Powered Help Desk, Live Chat & AI Chat Bot Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.5. This is due to missing or incorrect nonce validation on the hs_update_ai_chat_settings() function. This makes it possible for unauthenticated attackers to reconfigure the plugin’s AI/chat settings (including API keys) and to potentially redirect notifications or leak data to attacker-controlled endpoints via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Published: 2025-06-06T06:42:49.240Z
Updated: 2026-04-08T16:52:16.318Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-5018 |
vulnerable | 2026-06-08 07:35:23.920822 |
Hive Support <= 1.2.5 - Authenticated (Subscriber+) Missing Authorization via hs_update_ai_chat_settings and hive_lite_support_get_all_binbox
HIGH (7.1)
The Hive Support plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the hs_update_ai_chat_settings() and hive_lite_support_get_all_binbox() functions in all versions up to, and including, 1.2.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read and overwrite the site’s OpenAI API key and inspection data or modify AI-chat prompts and behavior. This vulnerability is potentially a duplicate of CVE-2025-32208 or/and CVE-2025-32242.
Published: 2025-06-06T06:42:51.453Z
Updated: 2026-04-08T17:10:06.546Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.