WordPress Click to Chat plugin <= 4.22 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via data-no_number Parameter vulnerability

Authenticated Contributor+ Stored DOM-Based Cross-Site Scripting via data-nonumber Parameter vulnerability discovered by Asaf Mozes in WordPress Plugin Click to Chat versions = 4.22...

CVE-2025-5336

creationtimestamp| type| source ---|---|--- 2025-06-14 08:34:05+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/18361...

CVE-2025-5336 Click to Chat <= 4.22 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via data-no_number Parameter

The Click to Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-nonumber’ parameter in all versions up to, and including, 4.22 to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level acces...