117 matches found
WordPress Click n Chat (Chat Widget Integration) plugin 1.0.4-1.1.2 - Unauthenticated SQLi vulnerability
Unauthenticated SQLi vulnerability discovered by Erwan LR WPScan in WordPress Plugin Click n Chat Chat Widget Integration versions 1.0.4-1.1.2...
WordPress Click n Chat (Chat Widget Integration) plugin < 1.1.3 - Unauthenticated SQLi vulnerability
Unauthenticated SQLi vulnerability discovered by Ryan Fabella in WordPress Plugin Click n Chat Chat Widget Integration versions 1.1.3...
CVE-2026-92998
The Click n Chat Chat Widget Integration WordPress plugin before 1.1.3 does not sanitise sort parameters before using them in a SQL ORDER BY clause, allowing unauthenticated attackers to perform SQL injection attacks...
CVE-2026-92999
The Click n Chat Chat Widget Integration WordPress plugin before 1.1.3 does not perform any authorization check on a lead-export handler, allowing unauthenticated users to download every captured contact record names, email addresses and phone numbers...
CVE-2026-92997
The Click n Chat Chat Widget Integration WordPress plugin before 1.1.3 does not properly validate a parameter before using it as a column identifier in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks...
EUVD-2026-107044
The Click n Chat Chat Widget Integration WordPress plugin before 1.1.3 does not perform any authorization check on a lead-export handler, allowing unauthenticated users to download every captured contact record names, email addresses and phone numbers...
WordPress Click n Chat (Chat Widget Integration) plugin 1.0.4-1.1.2 - Unauthenticated Lead Data Disclosure vulnerability
Unauthenticated Lead Data Disclosure vulnerability discovered by Mokksh Parekh in WordPress Plugin Click n Chat Chat Widget Integration versions 1.0.4-1.1.2...
EUVD-2026-107089
The Click n Chat Chat Widget Integration WordPress plugin before 1.1.3 does not properly validate a parameter before using it as a column identifier in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks...
EUVD-2026-107043
The Click n Chat Chat Widget Integration WordPress plugin before 1.1.3 does not sanitise sort parameters before using them in a SQL ORDER BY clause, allowing unauthenticated attackers to perform SQL injection attacks...
PT-2026-120485
The Click n Chat Chat Widget Integration WordPress plugin before 1.1.3 does not properly validate a parameter before using it as a column identifier in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks...
PT-2026-120487
The Click n Chat Chat Widget Integration WordPress plugin before 1.1.3 does not perform any authorization check on a lead-export handler, allowing unauthenticated users to download every captured contact record names, email addresses and phone numbers...
PT-2026-120486
The Click n Chat Chat Widget Integration WordPress plugin before 1.1.3 does not sanitise sort parameters before using them in a SQL ORDER BY clause, allowing unauthenticated attackers to perform SQL injection attacks...
CVE-2026-15462
The Sticky Chat Widget plugin for WordPress is vulnerable to SQL Injection via the 'scwformfields' parameter array keys of the 'scwsaveformdata' AJAX action in versions up to, and including, 1.4.2. This is due to the saveformdata function passing attacker-controlled POST array keys unsanitized to...
CVE-2026-15462 Sticky Chat Widget <= 1.4.2 - Unauthenticated SQL Injection
The Sticky Chat Widget plugin for WordPress is vulnerable to SQL Injection via the 'scwformfields' parameter array keys of the 'scwsaveformdata' AJAX action in versions up to, and including, 1.4.2. This is due to the saveformdata function passing attacker-controlled POST array keys unsanitized to...
CVE-2026-15462
CVE-2026-15462 affects the Sticky Chat Widget WordPress plugin in versions up to and including 1.4.2 . The vulnerability is an unauthenticated SQL injection via the scw_form_fields parameter array keys in the scw_save_form_data AJAX action. The save_form_data() function passes attacker-controlled...
CVE-2026-15462 Sticky Chat Widget <= 1.4.2 - Unauthenticated SQL Injection
The Sticky Chat Widget plugin for WordPress is vulnerable to SQL Injection via the 'scwformfields' parameter array keys of the 'scwsaveformdata' AJAX action in versions up to, and including, 1.4.2. This is due to the saveformdata function passing attacker-controlled POST array keys unsanitized to...
EUVD-2026-75954
The Sticky Chat Widget plugin for WordPress is vulnerable to SQL Injection via the 'scwformfields' parameter array keys of the 'scwsaveformdata' AJAX action in versions up to, and including, 1.4.2. This is due to the saveformdata function passing attacker-controlled POST array keys unsanitized to...
CVE-2026-15462: Improper Neutralization of Special Elements used in an SQL Command
The Sticky Chat Widget plugin for WordPress is vulnerable to SQL Injection via the 'scwformfields' parameter array keys of the 'scwsaveformdata' AJAX action in versions up to, and including, 1.4.2. This is due to the saveformdata function passing attacker-controlled POST array keys unsanitized to...
PT-2026-89748
Name of the Vulnerable Software and Affected Versions Sticky Chat Widget versions prior to 1.4.3 Description Unauthenticated attackers can perform SQL Injection through the scw form fields parameter array keys within the scw save form data AJAX action. The issue occurs because the save form data...