TI-2026-29434 CVE-2026-40765 · GHSA-4w22-gv7q-mh5h
WordPress collectchat plugin <= 2.4.9 - Cross Site Scripting (XSS) vulnerability
Priority LOW 31
Unauthenticated Cross Site Scripting (XSS) in collectchat <= 2.4.9 versions.
collectchat
Records4All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9
Exploited now
collectchat records in CISA KEVNo collectchat vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
4 records
TI-2024-20162 CVE-2024-30436 · GHSA-qc2c-wgwh-39x8
WordPress Collect.chat plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability
Priority LOW 29
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Collect.Chat Inc.
TI-2026-00523 CVE-2026-0736 · GHSA-whjx-jr95-pc2f
Cross-site scripting in collectchat Chatbot for WordPress by Collect.chat ⚡️
Priority LOW 28
The Chatbot for WordPress by Collect.chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_inpost_head_script[synth_header_script]' post meta field in all versions up to, and including, 2.4.8 d…
TI-2023-05234 CVE-2023-5691 · GHSA-mjqr-c54m-3wf3
Cross-site scripting in collectchat Collect.chat Chatbot ⚡️
Priority LOW 22
The Chatbot for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in version 2.3.9 due to insufficient input sanitization and output escaping.