Floating Chat Widget
Monthly
Reflected XSS in the Chaty (Floating Chat Widget) WordPress plugin by Premio affects all versions through 3.5.9, allowing unauthenticated attackers to inject arbitrary JavaScript into a victim's browser session by tricking them into clicking a crafted search URL. The root cause is a subtle DOM-level bypass: WordPress server-side HTML-encodes the 's' search parameter into the page title, but the plugin's frontend JavaScript reads that title via jQuery's `.text()` method, which invokes the browser DOM API and silently decodes the HTML entities back to raw characters before embedding the value unescaped into an HTML attribute. Wordfence has confirmed the vulnerability and a corrective code change is visible in the WordPress plugin repository changeset; no public exploit code has been identified at time of analysis.
The Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button, WhatsApp - Chaty plugin for WordPress is vulnerable to Stored Cross-Site Scripting via. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button WordPress plugin before 3.2.3 does not sanitise and escape some of its settings,. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button WordPress plugin before 3.1.9 does not sanitise and escape some of its settings,. Rated low severity (CVSS 3.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Reflected XSS in the Chaty (Floating Chat Widget) WordPress plugin by Premio affects all versions through 3.5.9, allowing unauthenticated attackers to inject arbitrary JavaScript into a victim's browser session by tricking them into clicking a crafted search URL. The root cause is a subtle DOM-level bypass: WordPress server-side HTML-encodes the 's' search parameter into the page title, but the plugin's frontend JavaScript reads that title via jQuery's `.text()` method, which invokes the browser DOM API and silently decodes the HTML entities back to raw characters before embedding the value unescaped into an HTML attribute. Wordfence has confirmed the vulnerability and a corrective code change is visible in the WordPress plugin repository changeset; no public exploit code has been identified at time of analysis.
The Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button, WhatsApp - Chaty plugin for WordPress is vulnerable to Stored Cross-Site Scripting via. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button WordPress plugin before 3.2.3 does not sanitise and escape some of its settings,. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button WordPress plugin before 3.1.9 does not sanitise and escape some of its settings,. Rated low severity (CVSS 3.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.