Stored Cross-Site Scripting in Chaty Plugin for WordPress
CVE-2025-1450
5.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 27 February 2025
What is CVE-2025-1450?
The Chaty plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability due to insufficient input sanitization and output escaping in the 'data-hover' parameter. Authenticated users with Contributor-level access and above can exploit this flaw to inject arbitrary scripts into web pages. Once injected, these scripts will execute each time a user accesses the affected page, leading to potential security risks such as data theft or session hijacking.
Affected Version(s)
Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button, WhatsApp – Chaty * <= 3.3.5