PLUGIN SECURITY
Is Facebook Chat Plugin – Live Chat Plugin for WordPress safe?
The Facebook Chat Plugin makes it easy for your website visitors to chat with you and ask you questions, even if they don't have Messenger.
What this plugin does
- Slug:
facebook-messenger-customer-chat - Author: Facebook
- 70000+ active installs
- 70/100 rating (302 reviews on wordpress.org)
- 1759038 all-time downloads
- On WordPress.org since 2018-09-26
chatcustomer carefacebookmessagingmessenger
Maintenance status
- Latest known version: 2.5
- Last updated: 2022-07-05 11:01pm GMT
- Tested up to WordPress: 5.9.16
- Requires PHP: 5.2.4+
⚠ Facebook Chat Plugin – Live Chat Plugin for WordPress hasn't been updated in over 1518 days. An unmaintained plugin doesn't receive new security fixes, which is itself a security risk even without a known CVE.
Known vulnerabilities
1 known CVE on file for Facebook Chat Plugin – Live Chat Plugin for WordPress. Reported between 2019 and 2020.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| — | Facebook Chat Plugin – Live Chat Plugin for WordPress [facebook-messenger-customer-chat] < 1.6 | — | Unknown | < 1.6 | 1.6 | 2020-08-04 | ✓ fixed in latest |
| CVE-2020-36838 | Facebook Chat Plugin – Live Chat Plugin for WordPress [facebook-messenger-customer-chat] < 1.6 | Improper Access Control | High 7.4 | < 1.6 | 1.6 | 2020-08-04 | ✓ fixed in latest |
| — | Facebook Chat Plugin – Live Chat Plugin for WordPress [facebook-messenger-customer-chat] < 1.3 | — | Unknown | < 1.3 | 1.3 | 2019-06-17 | ✓ fixed in latest |
| — | Facebook Chat Plugin – Live Chat Plugin for WordPress [facebook-messenger-customer-chat] < 1.6 | — | Unknown | < 1.6 | 1.6 | — | ✓ fixed in latest |
| — | Facebook Chat Plugin – Live Chat Plugin for WordPress [facebook-messenger-customer-chat] < 1.3 | — | Unknown | < 1.3 | 1.3 | — | ✓ fixed in latest |
| — | The Official Facebook Chat Plugin < 1.3 - CSRF | — | Unknown | < 1.3 | 1.3 | — | ✓ fixed in latest |
| — | The Official WordPress Facebook Chat Plugin < 1.6 - Authenticated Options Change to Chat Takeover | — | Unknown | < 1.6 | 1.6 | — | ✓ fixed in latest |
How to fix it
Keep Facebook Chat Plugin – Live Chat Plugin for WordPress updated — 2.5 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- Joinchat – Enhanced "click to chat" — 700000+ active installs — 94/100 (189) — max PHP 8.4
- Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty — 300000+ active installs — 100/100 (1240) — max PHP 8.4
- Tidio – Live Chat & AI Chatbots — 70000+ active installs — 94/100 (396) — max PHP 8.4
- Buttonizer – Live Chat, AI Chatbot, Call, Chat, Contact Button — 50000+ active installs — 100/100 (23)
- Simple Chat Button — 40000+ active installs — 96/100 (15)
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.