Reflected Cross-Site Scripting Vulnerability in Chaty Plugin for WordPress
CVE-2026-18964

6.1MEDIUM

Key Information:

Vendor

WordPress
Status
Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, Wechat, Email, Sms, Call Button – Chaty
Vendor
CVE Published:
11 September 2026

What is CVE-2026-18964?

The Chaty plugin for WordPress is susceptible to a Reflected Cross-Site Scripting (XSS) vulnerability, allowing attackers to inject arbitrary web scripts via the 's' parameter. This occurs due to inadequate input sanitization and output escaping in all versions up to and including 3.5.9. If an attacker successfully deceives a user into interacting with a malicious link, they can exploit this vulnerability, resulting in potential unauthorized actions being executed in the context of the user's session. The default HTML encoding by WordPress does not prevent the browser DOM API from decoding HTML entities, which leads to a bypass of security measures, allowing special characters to be embedded unescaped into HTML attributes.

Affected Version(s)

Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty 0 <= 3.5.9

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/chaty/trunk/js...
https://plugins.trac.wordpress.org/changeset?sfp_email=&s...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

uhcna
.