CVE-2026-104748

The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.10.0 This is due to the wpajaxnoprivsimpleformwpregister AJAX action lacking any capability check for role...

CVE-2026-92097

The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.44 This is due to the greetingsdialog function building the url template placeholder from a sanitizetextfield-filtered $SERVER'REQUESTURI' on archive pages and th...

CVE-2026-92097 Click to Chat <= 4.44 - Unauthenticated Arbitrary Shortcode Execution via REQUEST_URI via {url} Placeholder

The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.44 This is due to the greetingsdialog function building the url template placeholder from a sanitizetextfield-filtered $SERVER'REQUESTURI' on archive pages and th...

EUVD-2026-100770

The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.44 This is due to the greetingsdialog function building the url template placeholder from a sanitizetextfield-filtered $SERVER'REQUESTURI' on archive pages and th...

CVE-2026-92097

The Click to Chat for WhatsApp plugin for WordPress (versions up to and including 4.44 ) is vulnerable to Unauthenticated Arbitrary Shortcode Execution . The issue originates in the greetings_dialog() function, which constructs the {url} template placeholder using a sanitize_text_field()-filtered...

PT-2026-113600

The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.44 This is due to the greetings dialog function building the url template placeholder from a sanitize text field-filtered $ SERVER'REQUEST URI' on archive pages a...

PT-2026-113710

The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.10.0 This is due to the wp ajax nopriv simpleform wp register AJAX action lacking any capability check for role...

CVE-2026-110217

Lenve vhr through commit 03abbd3 contains an information disclosure vulnerability that allows any authenticated user to retrieve other operators' BCrypt password hashes via GET /chat/hrs. Low-privileged operators can collect administrator password hashes, phone numbers, and addresses from the...

CVE-2026-110217 vhr through commit 03abbd3 Information Disclosure of Operator Password Hashes via GET /chat/hrs

Lenve vhr through commit 03abbd3 contains an information disclosure vulnerability that allows any authenticated user to retrieve other operators' BCrypt password hashes via GET /chat/hrs. Low-privileged operators can collect administrator password hashes, phone numbers, and addresses from the...

CVE-2026-110217

The Lenve vhr application (through commit 03abbd3 ) contains an information disclosure vulnerability. This flaw allows any authenticated user to access other operators' BCrypt password hashes by sending a GET request to the /chat/hrs endpoint. Specifically, low-privileged operators can retrieve s...

CVE-2026-110217 vhr through commit 03abbd3 Information Disclosure of Operator Password Hashes via GET /chat/hrs

Lenve vhr through commit 03abbd3 contains an information disclosure vulnerability that allows any authenticated user to retrieve other operators' BCrypt password hashes via GET /chat/hrs. Low-privileged operators can collect administrator password hashes, phone numbers, and addresses from the...

WordPress Click to Chat – HoliThemes plugin <= 4.44 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Kuba in WordPress Plugin Click to Chat versions = 4.44...

CVE-2026-66751-Insufficient-Access-Controls-Allow-for-Unauthorized-Room-Deletion-Let-s-Chat-

Security Advisory: Insufficient Access Controls Allow for Unauthorized Room Deletion Let's Chat Assigned CVE ID: CVE-2026-66751 Summary DELETE /rooms/:room performs no authorization check beyond requiring a login. Any account can archive any room on the server, including private, password protect...

CVE-2026-66749-Unchecked-Room-Lookup-Leads-to-Server-Crash-Let-s-Chat-

Security Advisory: Unchecked Room Lookup Leads to Server Crash Let's Chat Assigned CVE ID: CVE-2026-66749 Summary One HTTP request from any logged-in account shuts down the Let's Chat server process. GET /messages takes a room parameter, looks that room up by id, and then calls a method on the...

CVE-2017-9544

CVE-2017-9544 Exploit for SEH based buffer overflow in Easy Chat Server CVE-2017-9544 Based on: pwntools msfvenom / reversetcp payload ropper x64dbg Vulnerable app available at https://www.exploit-db.com/exploits/42155 Setup Set victim IP to 192.168.15.100 and start Easy Chat Server. Set attacker...

CVE-2025-51859

CVE-2025-51859 Vulnerability description Chaindesk, a web application for constructing AI Agents, is vulnerable to Stored Cross-Site Scripting XSS in its agent chat component. An attacker can achieve arbitrary client-side script execution by crafting an AI agent whose system prompt instructs the...

CVE-2025-51863

CVE-2025-51863 Vulnerability description ChatGPTUtil is a AI-powered chatbot assistant, providing access to both ChatGPT and an AI image generator. A Self Cross-Site Scripting Self-XSS vulnerability exists in the chat component. This can lead to cookie theft leading to remote account hijacking...

CVE-2025-51864

CVE-2025-51864 Vulnerability description AIBOX is a web application for exploring AI consulting and trying out multiple LLMs. It allows users to chat with various LLMs. A reflected cross-site scripting XSS vulnerability exists in the chat component, which could lead to JWT token theft and remote...

CVE-2025-51400

Exploit Title: LiveHelperChat 4. Save the changes. 5. Try to use the personal canned message, the cross site scripting xss will execute. !...

CVE-2025-51862

CVE-2025-51862 Vulnerability description TelegAI, a web application for constructing and chatting with AI Characters, is vulnerable to Insecure Direct Object Reference IDOR in its chat component. An attacker can exploit this IDOR to tamper other users' conversation. Additionally, malicious conten...