36 matches found
CVE-2026-73360
Unauthenticated Cross Site Scripting XSS in Chaty Pro = 3.5.8 versions...
CVE-2026-73360
Unauthenticated Cross Site Scripting XSS in Chaty Pro = 3.5.8 versions...
EUVD-2026-60784
Unauthenticated Cross Site Scripting XSS in Chaty Pro = 3.5.8 versions...
CVE-2026-73360 WordPress Chaty Pro plugin <= 3.5.8 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Chaty Pro = 3.5.8 versions...
CVE-2026-73360
The WordPress Chaty Pro plugin (versions ≤ 3.5.8) has an unauthenticated reflected/stored XSS flaw exploitable over the network with low complexity; Patchstack rates it HIGH (CVSS 7.1). Upgrade beyond 3.5.8 to mitigate. No in-the-wild exploitation reported. https://patchstack.com/database/wordpre...
CVE-2026-73360 WordPress Chaty Pro plugin <= 3.5.8 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Chaty Pro = 3.5.8 versions...
CVE-2026-73360: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Chaty Pro = 3.5.8 versions...
PT-2026-77098
Unauthenticated Cross Site Scripting XSS in Chaty Pro = 3.5.8 versions...
WordPress Chaty Pro plugin <= 3.5.8 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Chaty Pro versions = 3.5.8...
WordPress Chaty Pro plugin <= 3.5.5 - Authenticated (Subscriber+) SQL Injection vulnerability
Authenticated Subscriber+ SQL Injection vulnerability discovered by h0xilo in WordPress Plugin Chaty Pro versions = 3.5.5...
CVE-2026-6251
The Chaty Pro plugin for WordPress is vulnerable to Authenticated Time-Based Blind SQL Injection in versions up to and including 3.5.5. This is due to the fetchcustomfield function in admin/class-admin-base.php retrieving the widgetid POST parameter via filterinputINPUTPOST, ... and directly...
CVE-2026-6251 Chaty Pro <= 3.5.5 - Authenticated (Subscriber+) SQL Injection via 'widget_id' Parameter
The Chaty Pro plugin for WordPress is vulnerable to Authenticated Time-Based Blind SQL Injection in versions up to and including 3.5.5. This is due to the fetchcustomfield function in admin/class-admin-base.php retrieving the widgetid POST parameter via filterinputINPUTPOST, ... and directly...
CVE-2026-6251
Chaty Pro for WordPress (≤ version 3.5.5) is affected by an authenticated time-based blind SQL injection via the widget_id parameter in POST data. The vulnerability arises because fetch_custom_field() concatenates the raw POST value into a numeric SQL context without proper preparation (no $wpdb-...
EUVD-2026-49690
The Chaty Pro plugin for WordPress is vulnerable to Authenticated Time-Based Blind SQL Injection in versions up to and including 3.5.5. This is due to the fetchcustomfield function in admin/class-admin-base.php retrieving the widgetid POST parameter via filterinputINPUTPOST, ... and directly...
CVE-2026-6251 Chaty Pro <= 3.5.5 - Authenticated (Subscriber+) SQL Injection via 'widget_id' Parameter
The Chaty Pro plugin for WordPress is vulnerable to Authenticated Time-Based Blind SQL Injection in versions up to and including 3.5.5. This is due to the fetchcustomfield function in admin/class-admin-base.php retrieving the widgetid POST parameter via filterinputINPUTPOST, ... and directly...
CVE-2026-6251
The Chaty Pro plugin for WordPress is vulnerable to Authenticated Time-Based Blind SQL Injection in versions up to and including 3.5.5. This is due to the fetchcustomfield function in admin/class-admin-base.php retrieving the widgetid POST parameter via filterinputINPUTPOST, ... and directly...
CVE-2026-6251: Improper Neutralization of Special Elements used in an SQL Command
The Chaty Pro plugin for WordPress is vulnerable to Authenticated Time-Based Blind SQL Injection in versions up to and including 3.5.5. This is due to the fetchcustomfield function in admin/class-admin-base.php retrieving the widgetid POST parameter via filterinputINPUTPOST, ... and directly...
PT-2026-65402
The Chaty Pro plugin for WordPress is vulnerable to Authenticated Time-Based Blind SQL Injection in versions up to and including 3.5.5. This is due to the fetch custom field function in admin/class-admin-base.php retrieving the widget id POST parameter via filter inputINPUT POST, ... and directly...
