Vulnerabilities

TI-2026-73776 CVE-2026-92097 · GHSA-4768-hg42-39c5

Click to Chat <= 4.44 - Unauthenticated Arbitrary Shortcode Execution via REQUEST_URI via {url} Placeholder

MEDIUM 48

The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.44 This is due to the greetings_dialog() function building the {url} template placeho…

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00525 Published 2026-10-14 No fix listed CWE-94

TI-2026-06863 CVE-2026-7795 · GHSA-gw8m-44wf-cqjf

Click to Chat <= 4.39 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'num' Shortcode Parameter

LOW 29

The Click to Chat – WA Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the [chat] shortcode 'num' parameter in all versions up to, and including, 4.38.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00407 Published 2026-06-06 No fix listed CWE-79

TI-2025-04791 CVE-2025-5336 · GHSA-83pp-hvhj-8fv5

Click to Chat <= 4.22 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via data-no_number Parameter

LOW 28

The Click to Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-no_number’ parameter in all versions up to, and including, 4.22 to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.0028 Published 2025-06-14 No fix listed CWE-79

TI-2024-08924 CVE-2024-9619 · GHSA-525c-m78q-ggxq

WP SHAPES <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

LOW 28

The WP SHAPES plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00283 Published 2024-12-20 No fix listed CWE-79

TI-2024-03589 CVE-2024-3849 · GHSA-7798-prfc-2jxq

Click to Chat – HoliThemes <= 3.35 - Authenticated (Contributor+) Local File Inclusion

MEDIUM 43

The Click to Chat – HoliThemes plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.35.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01691 Published 2024-05-02 No fix listed CWE-98

TI-2022-04095 CVE-2022-4480 · GHSA-9xj4-5v95-cwmv

Click to Chat < 3.18.1 - Contributor+ Stored XSS

MEDIUM 58

The Click to Chat WordPress plugin before 3.18.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00539 Published 2023-01-16 Fixed in 3.18.1 CWE-79