CVE-2026-6251

The Chaty Pro plugin for WordPress is vulnerable to Authenticated Time-Based Blind SQL Injection in versions up to and including 3.5.5. This is due to the fetchcustomfield function in admin/class-admin-base.php retrieving the widgetid POST parameter via filterinputINPUTPOST, ... and directly...

CVE-2026-6251 Chaty Pro <= 3.5.5 - Authenticated (Subscriber+) SQL Injection via 'widget_id' Parameter

The Chaty Pro plugin for WordPress is vulnerable to Authenticated Time-Based Blind SQL Injection in versions up to and including 3.5.5. This is due to the fetchcustomfield function in admin/class-admin-base.php retrieving the widgetid POST parameter via filterinputINPUTPOST, ... and directly...

CVE-2026-6251

The Chaty Pro plugin for WordPress is vulnerable to Authenticated Time-Based Blind SQL Injection in versions up to and including 3.5.5. This is due to the fetchcustomfield function in admin/class-admin-base.php retrieving the widgetid POST parameter via filterinputINPUTPOST, ... and directly...

CVE-2026-6251

Chaty Pro for WordPress (≤ version 3.5.5) is affected by an authenticated time-based blind SQL injection via the widget_id parameter in POST data. The vulnerability arises because fetch_custom_field() concatenates the raw POST value into a numeric SQL context without proper preparation (no $wpdb-...

EUVD-2026-49690

The Chaty Pro plugin for WordPress is vulnerable to Authenticated Time-Based Blind SQL Injection in versions up to and including 3.5.5. This is due to the fetchcustomfield function in admin/class-admin-base.php retrieving the widgetid POST parameter via filterinputINPUTPOST, ... and directly...

PT-2026-65402

The Chaty Pro plugin for WordPress is vulnerable to Authenticated Time-Based Blind SQL Injection in versions up to and including 3.5.5. This is due to the fetch custom field function in admin/class-admin-base.php retrieving the widget id POST parameter via filter inputINPUT POST, ... and directly...

EUVD-2025-4423

Malicious code in bioql PyPI...

CVE-2025-26776

Unrestricted Upload of File with Dangerous Type vulnerability in NotFound Chaty Pro allows Upload a Web Shell to a Web Server. This issue affects Chaty Pro: from n/a through 3.3.3...

CVE-2025-26776

Unrestricted Upload of File with Dangerous Type vulnerability in NotFound Chaty Pro allows Upload a Web Shell to a Web Server. This issue affects Chaty Pro: from n/a through 3.3.3...

CVE-2025-26776 WordPress Chaty Pro Plugin <= 3.3.3 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in NotFound Chaty Pro allows Upload a Web Shell to a Web Server. This issue affects Chaty Pro: from n/a through 3.3.3...

CVE-2025-26776

CVE-2025-26776 affects WordPress Chaty Pro plugin versions n/a through 3.3.3. The root cause is an Unrestricted Upload of File with Dangerous Type, enabling an attacker to upload a Web Shell to the web server. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) indicates a remote, unauthent...

CVE-2025-26776 WordPress Chaty Pro Plugin <= 3.3.3 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in NotFound Chaty Pro allows Upload a Web Shell to a Web Server. This issue affects Chaty Pro: from n/a through 3.3.3...

WordPress plugin Chaty Pro 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability...

PT-2025-7614 · Unknown · Notfound Chaty Pro

Name of the Vulnerable Software and Affected Versions: Chaty Pro versions n/a through 3.3.3 Description: The issue affects Chaty Pro, allowing an attacker to upload malicious files that can be used to take control of a website. This is due to an Unrestricted Upload of File with Dangerous Type...

WordPress Chaty Pro Plugin <= 3.3.3 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by luc Patchstack in WordPress Plugin Chaty Pro versions = 3.3.3...

WordPress Chaty Pro Plugin < 2.8.2 XSS Vulnerability

The WordPress plugin Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...

CVE-2021-25016

The Chaty WordPress plugin before 2.8.3 and Chaty Pro WordPress plugin before 2.8.2 do not sanitise and escape the search parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting...

CVE-2021-25016

The Chaty WordPress plugin before 2.8.3 and Chaty Pro WordPress plugin before 2.8.2 do not sanitise and escape the search parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting...

Cross site scripting

The Chaty WordPress plugin before 2.8.3 and Chaty Pro WordPress plugin before 2.8.2 do not sanitise and escape the search parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting...

WordPress plugin Chaty 跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress Chaty versions prior to 2.8.3 and WordPress...