Chaty Pro
Monthly
Unauthenticated cross-site scripting in Chaty Pro (WordPress plugin by Premio, versions ≤ 3.5.8) enables remote attackers without any credentials to inject malicious JavaScript into pages served to site visitors and administrators, with the CVSS scope change (S:C) indicating the payload can affect security principals beyond the plugin itself - including stealing admin session tokens or performing privileged actions on behalf of logged-in users. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) places this as a low-complexity, network-accessible attack requiring only that a victim load an affected page. No public exploit code and no CISA KEV listing have been identified at time of analysis, per Patchstack's disclosure and ENISA EUVD-2026-60784.
SQL injection in the Chaty Pro WordPress plugin (up to version 3.5.5) allows authenticated attackers with subscriber-level access to extract sensitive database contents, including user credentials and configuration data. The vulnerability exists in the fetch_custom_field() function, which directly concatenates the widget_id POST parameter into a raw SQL query without using $wpdb->prepare(). No public exploit or active exploitation has been identified at the time of analysis, and the risk is elevated by the low privilege requirement.
Unauthenticated cross-site scripting in Chaty Pro (WordPress plugin by Premio, versions ≤ 3.5.8) enables remote attackers without any credentials to inject malicious JavaScript into pages served to site visitors and administrators, with the CVSS scope change (S:C) indicating the payload can affect security principals beyond the plugin itself - including stealing admin session tokens or performing privileged actions on behalf of logged-in users. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) places this as a low-complexity, network-accessible attack requiring only that a victim load an affected page. No public exploit code and no CISA KEV listing have been identified at time of analysis, per Patchstack's disclosure and ENISA EUVD-2026-60784.
SQL injection in the Chaty Pro WordPress plugin (up to version 3.5.5) allows authenticated attackers with subscriber-level access to extract sensitive database contents, including user credentials and configuration data. The vulnerability exists in the fetch_custom_field() function, which directly concatenates the widget_id POST parameter into a raw SQL query without using $wpdb->prepare(). No public exploit or active exploitation has been identified at the time of analysis, and the risk is elevated by the low privilege requirement.