CVE Search Engine - Security Vulnerabilities and Exploits Search Tool

show all

57 matches found

Cvelist•added 2026/09/18 6:38 a.m.•36 views

CVE-2026-18317 Foxtool All-in-One: Contact chat button, Custom login, Media optimize images <= 2.5.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Modification via 'option_key' Parameter of toggle_watermark AJAX Action

The Foxtool All-in-One: Contact chat button, Custom login, Media optimize images plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it...

4.3CVSS0.00213EPSS

SaveExploits0References5

Rapid7 Vulnerability Database (full)•added 2026/09/18 12:00 a.m.•1 views

CVE-2026-18317: Missing Authorization

4.3CVSS5.7AI score0.00213EPSS

SaveExploits0References2

EUVD•added 2026/09/05 5:30 a.m.•15 views

EUVD-2026-71843

The Social Chat – Click To Chat App Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'consentmessage' JSON Attribute in .qlwapp data-box in all versions up to, and including, 8.6.2 due to insufficient input sanitization and output escaping. This makes it possible for...

6.4CVSS5.7AI score0.00201EPSS

SaveExploits0References7

Positive Technologies•added 2026/09/05 12:00 a.m.•19 views

PT-2026-86309

The Social Chat – Click To Chat App Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'consent message' JSON Attribute in .qlwapp data-box in all versions up to, and including, 8.6.2 due to insufficient input sanitization and output escaping. This makes it possible for...

6.4CVSS5.7AI score0.00201EPSS

SaveExploits0References8

Rapid7 Vulnerability Database (full)•added 2026/08/24 12:00 a.m.•1 views

CVE-2026-78268: Exposure of Sensitive System Information to an Unauthorized Control Sphere

Unauthenticated Sensitive Data Exposure in Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads = 1.2.0 versions...

7.5CVSS5.7AI score0.00416EPSS

SaveExploits0References2

Rapid7 Vulnerability Database (full)•added 2026/07/17 12:00 a.m.•2 views

CVE-2026-15759: Improper Neutralization of Input During Web Page Generation

The ChatHelp – Click to Chat Button, WooCommerce Chat to Order & Floating Chat Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'number' and 'group' Shortcode Attributes in all versions up to, and including, 3.5.1 due to insufficient input sanitization and output escapin...

6.4CVSS5.9AI score0.00349EPSS

SaveExploits0References2

Rapid7 Vulnerability Database (full)•added 2026/07/10 12:00 a.m.•1 views

CVE-2026-15291: Missing Authorization

The Chat Help – Click to Chat Button & Form plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.3 via the REST API endpoints /wp-json/chat-help/v1/leads and /wp-json/chat-help/v1/leads/id. This is due to the plugin not performing any...

7.5CVSS5.7AI score0.0066EPSS

SaveExploits0References2

Rapid7 Vulnerability Database (full)•added 2025/12/12 12:00 a.m.•1 views

CVE-2025-13408: Cross-Site Request Forgery (CSRF)

The Foxtool All-in-One: Contact chat button, Custom login, Media optimize images plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.2. This is due to missing or incorrect nonce validation on the foxtoollogingoogle function. This makes it...

4.3CVSS5.5AI score0.00176EPSS

SaveExploits0References1

EUVD•added 2025/10/03 8:07 p.m.•23 views

EUVD-2023-56092