Read the docs

holithemes

Records6All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9

Exploited now

holithemes records in CISA KEV

No holithemes vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Click To Chat 1 record MEDIUM

Records

6 records

TI-2022-04095 CVE-2022-4480 · GHSA-9xj4-5v95-cwmv

Click to Chat < 3.18.1 - Contributor+ Stored XSS

Priority MEDIUM 58

The Click to Chat WordPress plugin before 3.18.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00539 Published 2023-01-16 Fixed in 3.18.1 CWE-79
TI-2026-73776 CVE-2026-92097 · GHSA-4768-hg42-39c5

Click to Chat <= 4.44 - Unauthenticated Arbitrary Shortcode Execution via REQUEST_URI via {url} Placeholder

Priority MEDIUM 48

The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.44 This is due to the greetings_dialog() function building the {url} template placeho…

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00525 Published 2026-10-14 No fix listed CWE-94
TI-2025-04791 CVE-2025-5336 · GHSA-83pp-hvhj-8fv5

Click to Chat <= 4.22 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via data-no_number Parameter

Priority LOW 28

The Click to Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-no_number’ parameter in all versions up to, and including, 4.22 to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.0028 Published 2025-06-14 No fix listed CWE-79
Open these records in search →