EUVD-2026-75931
GHSA-634q-j8cp-w5hg
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-delivered reflected XSS with no authentication barrier; scope change (S:C) applies as browser-context script execution crosses origin; user interaction mandatory (UI:R); limited C/I impact from session exfiltration and page manipulation.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button - Chaty plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 3.5.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. WordPress's server-side HTML encoding of the 's' search parameter in the <title> element is bypassed because the browser DOM API decodes HTML entities when jQuery's .text() method reads document.title, returning literal special characters that are then embedded unescaped into the constructed HTML attribute value.
AnalysisAI
Reflected XSS in the Chaty (Floating Chat Widget) WordPress plugin by Premio affects all versions through 3.5.9, allowing unauthenticated attackers to inject arbitrary JavaScript into a victim's browser session by tricking them into clicking a crafted search URL. The root cause is a subtle DOM-level bypass: WordPress server-side HTML-encodes the 's' search parameter into the page title, but the plugin's frontend JavaScript reads that title via jQuery's .text() method, which invokes the browser DOM API and silently decodes the HTML entities back to raw characters before embedding the value unescaped into an HTML attribute. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target WordPress site has the Chaty plugin installed, active, and running version 3.5.9 or earlier. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.1 score (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) accurately characterizes the realistic risk envelope: network-reachable with no authentication barrier, but requiring that a user be socially engineered into clicking a crafted URL. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Chaty plugin to the latest available version via the WordPress dashboard or the official plugin repository, as the WordPress plugin repository changeset (comparing revision 3485342 to 3637386 of cht-front-script.min.js, viewable at the Trac changeset URL in the references) confirms the vulnerability has been patched in the plugin's trunk. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Floating Chat Widget
View allThe Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button W
The Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button W
The Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button, WhatsApp -
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today