Click N Chat Chat Widget Integration
Monthly
SQL injection in the Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 allows unauthenticated remote attackers to read arbitrary WordPress database contents by controlling a sort parameter that is placed directly into an SQL ORDER BY clause. The assessed vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, so the practical impact is high confidentiality loss with no integrity or availability effect, and no authentication or user interaction is needed. Publicly available exploit code exists; exposure is limited to sites running an affected plugin version with the chat-widget request handler reachable.
Unauthenticated SQL injection in Click n Chat (Chat Widget Integration) before 1.1.3 allows remote attackers to influence SQL query structure by supplying a parameter that the plugin uses as a column identifier without validation, giving high confidentiality impact through database data exposure with no integrity or availability impact assessed. Publicly available exploit code exists, and only WordPress sites with this specific plugin below version 1.1.3 are exposed, making the affected population narrow. The independent assessment rates the issue as network-reachable, low-complexity, and unauthenticated with scope unchanged, while the supplied base score is 8.6.
Unauthenticated lead export in the Click n Chat (Chat Widget Integration) WordPress plugin, versions 1.0.4 up to but not including 1.1.3, allows any remote visitor to download the full set of captured contact records - names, email addresses and phone numbers - with no authentication, no user interaction and no non-default configuration required. Publicly available exploit code exists, and the issue was reported by WPScan as an information disclosure flaw (CWE-200). A vendor patch is available in version 1.1.3, which closes the missing authorization check on the lead-export handler.
SQL injection in the Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 allows unauthenticated remote attackers to read arbitrary WordPress database contents by controlling a sort parameter that is placed directly into an SQL ORDER BY clause. The assessed vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, so the practical impact is high confidentiality loss with no integrity or availability effect, and no authentication or user interaction is needed. Publicly available exploit code exists; exposure is limited to sites running an affected plugin version with the chat-widget request handler reachable.
Unauthenticated SQL injection in Click n Chat (Chat Widget Integration) before 1.1.3 allows remote attackers to influence SQL query structure by supplying a parameter that the plugin uses as a column identifier without validation, giving high confidentiality impact through database data exposure with no integrity or availability impact assessed. Publicly available exploit code exists, and only WordPress sites with this specific plugin below version 1.1.3 are exposed, making the affected population narrow. The independent assessment rates the issue as network-reachable, low-complexity, and unauthenticated with scope unchanged, while the supplied base score is 8.6.
Unauthenticated lead export in the Click n Chat (Chat Widget Integration) WordPress plugin, versions 1.0.4 up to but not including 1.1.3, allows any remote visitor to download the full set of captured contact records - names, email addresses and phone numbers - with no authentication, no user interaction and no non-default configuration required. Publicly available exploit code exists, and the issue was reported by WPScan as an information disclosure flaw (CWE-200). A vendor patch is available in version 1.1.3, which closes the missing authorization check on the lead-export handler.