What is the CVSS score of EUVD-2026-34949?

EUVD-2026-34949 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Click to Chat EUVD-2026-34949

| CVE-2026-7795 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-06 Wordfence

GHSA-gw8m-44wf-cqjf

PHP XSS WordPress RCE

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 03:54 vuln.today

CVE Published

Jun 06, 2026 - 02:28 nvd

MEDIUM 6.4

DescriptionCVE.org

The Click to Chat - WA Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the [chat] shortcode 'num' parameter in all versions up to, and including, 4.38. This is due to insufficient escaping when embedding user-supplied shortcode attribute values inside JavaScript string literals that are then placed in HTML event-handler attributes. The CCW_Shortcode::shortcode() function applies esc_attr() to the 'num' parameter (line 157), which converts single quotes to the HTML entity '. This entity-encoded value is then interpolated directly into a JavaScript window.open() call string delimited by single quotes (line 194/221), and that complete string is placed verbatim into an HTML onclick attribute in the style template files (e.g., sc-style-1.php line 6). Because browsers HTML-decode event attribute values before executing the embedded JavaScript, the ' entities are decoded back to literal single quotes at runtime, allowing the injected payload to break out of the JavaScript string context and execute arbitrary code. This makes it possible for authenticated attackers with Contributor-level access and above to inject arbitrary web scripts into pages that will execute whenever a user clicks the WhatsApp chat button rendered by the [chat] shortcode.

AnalysisAI

Stored Cross-Site Scripting in the Click to Chat - WA Widget WordPress plugin (holithemes, all versions through 4.38) allows authenticated Contributor-level users to inject persistent JavaScript payloads that execute in victim browsers when the rendered WhatsApp chat button is clicked. The root cause is a double-encoding bypass: esc_attr() sanitization produces HTML entities that are decoded back to literal characters by the browser's HTML parser before JavaScript evaluation inside an onclick event handler, completely defeating the intended escaping. No public exploit has been identified at time of analysis, but the detailed technical write-up from Wordfence combined with publicly browsable vulnerable source code significantly lowers the barrier to exploitation. Vendor-released patch version 4.39 is available.

Technical ContextAI

The affected product is identified by CPE cpe:2.3:a:holithemes:click_to_chat_-_holithemes:*:*:*:*:*:*:*:* - a PHP WordPress plugin providing WhatsApp chat widget functionality via the [chat] shortcode. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS). The specific failure involves a context mismatch during output encoding: the CCW_Shortcode::shortcode() function at class-ccw-shortcode.php line 157 applies WordPress's esc_attr() to the 'num' parameter, which is correct for HTML attribute contexts but insufficient here. The sanitized value is then string-interpolated inside a JavaScript window.open() call whose string delimiters are single quotes (lines 194 and 221), and the entire JavaScript expression is embedded as the value of an HTML onclick attribute in style template files such as sc-style-1.php line 6. The critical browser behavior that enables exploitation is that HTML event-handler attribute values are HTML-decoded before JavaScript evaluation - so esc_attr()'s conversion of ' to ' is reversed by the parser at runtime, restoring the literal single quote and allowing the attacker to break out of the JavaScript string context and inject arbitrary code.

RemediationAI

Upgrade to Click to Chat version 4.39 or later, which is confirmed as the patched release based on the WordPress plugin repository changeset at https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3557482%40click-to-chat-for-whatsapp&new=3557482%40click-to-chat-for-whatsapp. The fix should replace the esc_attr() call in the JavaScript string interpolation context with proper JavaScript string escaping (e.g., esc_js()) to prevent HTML entity re-decoding. If immediate upgrade is not feasible, the primary compensating control is to restrict WordPress Contributor role assignment - remove Contributor privileges from untrusted or unnecessary user accounts, since exploitation requires authenticated access at that level or above. As a secondary measure, a Web Application Firewall rule can be configured to block shortcode attribute values containing JavaScript event syntax or common XSS vectors targeting the 'num' parameter, though this may produce false positives on legitimate phone numbers containing special characters. Content Security Policy headers restricting inline JavaScript execution (script-src without 'unsafe-inline') would mitigate the impact of successful injection but require theme and plugin compatibility review and may break other site functionality. Wordfence's vulnerability advisory is available at https://www.wordfence.com/threat-intel/vulnerabilities/id/60440b26-1c0b-4fd0-a74a-ff5900d0e9b8.