CVE-2026-18964— Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button <= 3.5.9 - Reflected Cross-Site Scripting
Quick assessment
Affected
premio Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty 这个 WordPress 插件在 3.5.9 及以下的所有版本中，由于输入清理和输出转义不足，存在反射型跨站脚本（Reflected XSS）漏洞，漏洞通过 参数触发。这意味着未经身份验证的攻击者可以注入任意 Web 脚本，只要他们能成功诱骗用户执行某些操作（例如点击链接），这些脚本就会在页面
Possible ATT&CK Techniques 1 AI
T1189.002
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-18964
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button <= 3.5.9 - Reflected Cross-Site Scripting
Source: CVE Program / CVE List V5
Vulnerability Description
The Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 3.5.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. WordPress's server-side HTML encoding of the 's' search parameter in the <title> element is bypassed because the browser DOM API decodes HTML entities when jQuery's .text() method reads document.title, returning literal special characters that are then embedded unescaped into the constructed HTML attribute value.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| premio | Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty | 0 ~ 3.5.9 | - |
|
II. Public POCs for CVE-2026-18964
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-18964
请登录查看更多情报信息。
Security Blog Posts for CVE-2026-18964 (1)
IV. Related Vulnerabilities
Same vendor: premio
-
CVE-2026-73360
WordPress Chaty Pro plugin <= 3.5.8 - Cross Site Scripting ( -
CVE-2026-3657
My Sticky Bar <= 2.8.6 - Unauthenticated SQL Injection via ' -
CVE-2026-27370
WordPress Chaty plugin <= 3.5.1 - Sensitive Data Exposure vu -
CVE-2025-12640
Folders – Unlimited Folders to Organize Media Library Folder -
CVE-2025-14428
My Sticky Elements <= 2.3.3 - Missing Authorization to Authe
Same weakness: CWE-79
-
CVE-2026-17037
Kirki <= 6.2.0 - Unauthenticated Stored Cross-Site Scripting -
CVE-2026-6640
Media Library Assistant <= 3.35 - Authenticated (Contributor -
CVE-2026-6641
Media Library Assistant <= 3.35 - Authenticated (Contributor -
CVE-2026-6642
Media Library Assistant <= 3.35 - Authenticated (Author+) St -
CVE-2026-7438
Bold Timeline Lite <= 1.2.8 - Authenticated (Contributor+) S
V. Comments for CVE-2026-18964
No comments yet