Read the docs
TI-2021-07294 Aliases CVE-2021-25016GHSA-5jw4-xcrp-43f8

Chaty < 2.8.3 - Reflected Cross-Site Scripting

Priority LOW 31CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

The Chaty WordPress plugin before 2.8.3 and Chaty Pro WordPress plugin before 2.8.2 do not sanitise and escape the search parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting

Why it matters now

EPSS 0.01846 79th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Floating Chat Widget: Contact Icons, Messages, Telegram, Email, SMS, Call Button – Chaty (Unknown): 2.8.3Floating Chat Widget Pro - Chaty Pro (Unknown): 2.8.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownFloating Chat Widget: Contact Icons, Messages, Telegram, Email, SMS, Call Button – Chaty2.8.3 to before 2.8.32.8.3Patch availableCNA
UnknownFloating Chat Widget Pro - Chaty Pro2.8.2 to before 2.8.22.8.2Patch availableCNA
  • Floating Chat Widget: Contact Icons, Messages, Telegram, Email, SMS, Call Button – Chaty VendorUnknown Affected 2.8.3 to before 2.8.3 Fixed in 2.8.3 Patch available CNA
  • Floating Chat Widget Pro - Chaty Pro VendorUnknown Affected 2.8.2 to before 2.8.2 Fixed in 2.8.2 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:premio:chaty:*:*:*:*:*:wordpress:*:*before 2.8.3Vulnerablepremio
cpe:2.3:a:premio:chaty_pro:*:*:*:*:*:wordpress:*:*before 2.8.2Vulnerablepremio
  • cpe:2.3:a:premio:chaty:*:*:*:*:*:wordpress:*:* Versions before 2.8.3 Vulnerable ·premio
  • cpe:2.3:a:premio:chaty_pro:*:*:*:*:*:wordpress:*:* Versions before 2.8.2 Vulnerable ·premio

Remediation

  • Fix · CNA Floating Chat Widget: Contact Icons, Messages, Telegram, Email, SMS, Call Button – Chaty (Unknown) Fixed in 2.8.3
  • Fix · CNA Floating Chat Widget Pro - Chaty Pro (Unknown) Fixed in 2.8.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-25016
  2. 2026-10-03 Alias added: GHSA-5jw4-xcrp-43f8

References

Exploit 1

  • TI-2022-03536 Chaty < 3.0.3 - Admin+ SQLi CVSS 3.1HIGH 7.2
  • TI-2023-03041 Floating Chat Widget < 3.1.2 - Admin+ Stored Cross-Site Scripting CVSS 3.1MEDIUM 4.8
  • TI-2023-10492 WordPress Chaty Plugin <= 3.0.9 is vulnerable to Cross Site Scripting (XSS) CVSS 3.1HIGH 7.1
  • TI-2023-25869 WordPress Chaty plugin <= 3.1.2 - Cross Site Scripting (XSS) vulnerability CVSS 3.1MEDIUM 5.9
  • TI-2021-14944 WordPress Chaty plugin <= 2.8.3 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability CVSS 3.1MEDIUM 4.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences