Contact Forms, Live Support, CRM, Video Messages

Contact Forms, Live Support, CRM, Video Messages has one disclosed vulnerability in the WordSec catalog, all reported in 2024; it is fixed as of October 2026. Their average CVSS score is 5.3, and the most serious one scores 5.3 out of 10.

The most common weakness is Exposure Of Sensitive Information To An Unauthorized Actor, behind 1 of the records (100%).

The one issue recorded for Contact Forms, Live Support, CRM, Video Messages has a vendor fix available, so running the current release closes it.

All of these findings were reported by Joshua Chan. Contact Forms, Live Support, CRM, Video Messages is installed on roughly 10 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

Strategic Overview

Avg CVSSMedium
5.3/ 10
Patch Coverage100%
Open

0

Fixed

1

Get automatic notifications for all Contact Forms, Live Support, CRM, Video Messages vulnerabilities before they are exploited.

Highest severity on recordCVSS 5.3CVE-2024-49235

Contact Forms, Live Support, CRM, Video Messages <= 1.10.3 - Unauthenticated Information Disclosure

Read the full analysis

Vulnerability Records

1 records
Contact Forms, Live Support, CRM, Video Messages banner
Latestv1.12.10

Contact Forms, Live Support, CRM, Video Messages

videowhisper

Author

videowhisper

5.0(1)
100/100
Last Updated
2026-10-20 (8d ago)
Active Installs
10+
Downloads
4,736
Requires WP
5.7+
Requires PHP
7.4+
Tested up to
WP 7.1.3
Created
2022-06-23 (4y ago)

Revamp your customer service with this powerful tool that combines contact forms, support tickets, chat, and a comprehensive CRM system to enhance interaction and efficiency. Manage conversations front and back end, attach multimedia files, webcam recordings and customize contact forms for specific needs. A floating icon and reporting buttons on content facilitate communication, making it ideal for any business aiming to improve responsiveness and customer satisfaction. Benefits Unified Communication Platform: Integrates contact forms, support, chat, CRM into a single, efficient workflow. Enhanced Multimedia Support: Users can send messages with webcam, screen, and microphone recordings, enhancing interactive support. Customizable Contact Forms: Tailor contact forms with custom fields to collect specific information needed for various departments. Advanced Conversation Management: Manage and monitor conversations from both frontend and backend, improving service responsiveness. Email Confirmation for Security: Protects against spam by requiring email confirmation from visitors before starting conversations. Multilanguage Support: Offers real-time translation of messages with DeepL integration, catering to a global audience. Monetization Options: Integrates with the MicroPayments Plugin for paid support options, allowing for flexible revenue models. Comprehensive Reporting Tools: Easily report and manage content directly from posts with configurable buttons, enhancing content control. Features Support pages in website frontend for starting/accessing conversations Members can open a conversation directly, while visitors have to confirm their email first Admins can see and access open Conversations from backend Report Content button for any post types (configurable) Contact Owner button for any post types (configurable) Contact Creator in BuddyPress/BuddyBoss profile for configurable roles My Conversations page to website frontend, to access own tickets by logged in users Custom support departments for website / report content / contact content owner / contact user Floating support buttons (contact, new messages) on all pages (can be disabled) Message counter in backend (site support) and frontend (for creators) Send webcam/screen/microphone recordings and file uploads in conversations Protected software/resource downloads catalog with optional plan-based access control Secure download gateway with short-lived signed links (no direct file URL exposure in frontend) API endpoint for updater/client plugins to list authorized downloads by contact credentials Custom contact forms with custom fields (text, dropdown, toggle) and data saved per contact Custom form per department enables custom fields per conversation (ticket) Invite by email to fill a form, contact a department or join a new conversation Can messages, add to later messages for quick replies Integrates with MicroPayments Plugin for paid support (per conversation, message) Registration forms: register accounts in an external MySQL database, in example for VideoWhisper WebRTC server Multilanguage conversations with DeepL integration for translating messages on request Support Wiki pages with Markdown rendering for headings, lists, tables, images, code blocks, quotes, dividers, links, Fomantic UI-compatible classes when Fomantic is available, and a lightweight stylesheet loaded only on pages that render Support Wiki/Markdown content Integration hooks for VideoWhisper Site Manager / Site Manager Pro, enabling AI tools to read conversations, send CRM messages with native notifications, retrieve CRM stats, include external account counts when configured, and identify contact lead activity from conversation/message/account counts More features to come … External services DeepL: when a site administrator supplies an API key and enables translations, authenticated translation requests send message text and source/target languages to https://api.deepl.com or https://api-free.deepl.com. Updating the supported-language list sends the API credential. Service: https://www.deepl.com/ ; Terms: https://www.deepl.com/en/pro-license ; Privacy: https://www.deepl.com/en/privacy . Email: normal notifications use WordPress wp_mail and the site’s configured transport. If the administrator selects Postmark or Brevo and supplies credentials, notification/test requests send sender/recipient addresses, subject, message and configured headers to https://api.postmarkapp.com/email or https://api.brevo.com/v3/smtp/email. Postmark terms/privacy: https://postmarkapp.com/terms-of-service and https://postmarkapp.com/privacy-policy . Brevo terms/privacy: https://www.brevo.com/legal/termsofuse/ and https://www.brevo.com/legal/privacypolicy/ . No test email is sent automatically. Google reCAPTCHA: only when enabled with site/secret keys, covered forms load https://www.google.com/recaptcha/api.js and submit the response token (and visitor IP when supplied) to https://www.google.com/recaptcha/api/siteverify for spam checks. Service: https://cloud.google.com/security/products/recaptcha ; Terms: https://cloud.google.com/terms ; Privacy information: https://cloud.google.com/terms/cloud-privacy-notice . Site owners must configure any required visitor consent. Analytics: configured event names are sent to an existing window.gtag/dataLayer integration when present, including form/conversation event metadata. The plugin does not create a Google Analytics account. Site owners control analytics loading and consent. Google Analytics terms: https://marketingplatform.google.com/about/analytics/terms/us/ ; Privacy: https://policies.google.com/privacy . Optional streaming/account providers: only when their database/API/server settings are supplied, the plugin exchanges account, organization, plan, authentication, schedule, stream and usage information with those configured destinations. These may be self-hosted. Provider URLs, terms and privacy policies are determined by the administrator’s selected provider. VideoWhisper’s server project: https://github.com/videowhisper/videowhisper-webrtc . VideoWhisper service terms/privacy: https://www.videowhisper.com/view.php?p=Terms+of+Use and https://www.videowhisper.com/view.php?p=Privacy+Policy . Geolocation now uses local server GeoIP data only. The former automatic third-party IP lookup is removed. Trusted reverse proxies can be declared with the vws_support_trusted_proxy_ips filter; otherwise rate limits use the validated connecting IP address. Bundled libraries Fomantic UI 2.9.4 (MIT), https://github.com/fomantic/Fomantic-UI , and Chart.js 4.4.0 (MIT), https://github.com/chartjs/Chart.js , are served locally. Their license notices are included in semantic/LICENSE.md and static/vendor/chartjs/LICENSE.md. The legacy CDN setting no longer offloads these libraries. License This plugin is released under a GPL license.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C