EUVD-2026-60784
GHSA-g2qq-m538-m5rp
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Standard unauthenticated XSS with scope change into victim browser; availability impact removed as script injection alone does not disrupt service availability.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in Chaty Pro <= 3.5.8 versions.
AnalysisAI
Unauthenticated cross-site scripting in Chaty Pro (WordPress plugin by Premio, versions ≤ 3.5.8) enables remote attackers without any credentials to inject malicious JavaScript into pages served to site visitors and administrators, with the CVSS scope change (S:C) indicating the payload can affect security principals beyond the plugin itself - including stealing admin session tokens or performing privileged actions on behalf of logged-in users. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) places this as a low-complexity, network-accessible attack requiring only that a victim load an affected page. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication is required from the attacker (CVSS PR:N), consistent with the 'unauthenticated' classification in the CVE description - the vulnerable injection point is reachable by any external actor without a WordPress account. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.1 score reflects a meaningful but not exceptional risk profile: the network-accessible, unauthenticated attack vector and low complexity (AV:N/AC:L/PR:N) lower the bar for exploitation significantly, while the mandatory user interaction requirement (UI:R) acts as a real-world friction point that prevents fully passive, fire-and-forget exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker identifies a WordPress site running Chaty Pro ≤ 3.5.8, submits a crafted HTTP request containing a JavaScript payload (such as a cookie-stealing script) to the vulnerable plugin input or parameter, and the payload is rendered unencoded in a page accessible to logged-in users. A WordPress administrator visits the affected page - potentially via a socially engineered link - triggering the script in their browser, which exfiltrates their session cookie to an attacker-controlled endpoint and grants the attacker full administrative access to the WordPress installation. … |
| Remediation | The primary remediation is to update Chaty Pro to a version released after 3.5.8; the exact patched release number is not confirmed in the available input data and must be verified via the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/chaty-pro/vulnerability/wordpress-chaty-pro-plugin-3-5-8-cross-site-scripting-xss-vulnerability or the official WordPress plugin repository. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, scan all WordPress environments for Chaty Pro plugin versions ≤ 3.5.8 using vulnerability management tools (Wordfence, Sucuri, or equivalent) and disable or remove the plugin from production unless operationally critical. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today