SQL Injection Risk in Sticky Chat Widget for WordPress
CVE-2026-15462

7.5HIGH

Key Information:

Vendor

WordPress
Status
Sticky Chat Widget – Floating Chat Icons, Contact Form, Call, Click To Chat, Email & Message Buttons
Vendor
CVE Published:
11 September 2026

What is CVE-2026-15462?

The Sticky Chat Widget plugin for WordPress is susceptible to SQL Injection via the 'scw_form_fields' parameter in the 'scw_save_form_data' AJAX action. This vulnerability arises from the save_form_data() function using unsanitized POST array keys with $wpdb->insert(), which allows for manipulation of the SQL query. The lack of proper validation means that attackers can inject additional SQL queries, exposing sensitive database information. As the widget_id validation loop is bypassed, unauthorized attackers can exploit this vulnerability without needing valid credentials.

Affected Version(s)

Sticky Chat Widget – Floating Chat Icons, Contact Form, Call, Click to Chat, Email & Message Buttons 0 <= 1.4.2

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/sticky-chat-wi...
https://plugins.trac.wordpress.org/browser/sticky-chat-wi...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

WhiteFalcon
.