CVE-2026-12041: Stored XSS in Chatra Live Chat Plugin ≤1.0.12 for WordPress

Technical summary

CVE-2026-12041 is a Stored Cross-Site Scripting (XSS) vulnerability in the Chatra Live Chat + ChatBot + Cart Saver plugin affecting all versions through 1.0.12. The vulnerability stems from insufficient input sanitization and output escaping in the admin settings interface. An authenticated attacker with administrator-level or higher privileges can inject arbitrary JavaScript into the WordPress database via the plugin's settings form. The injected script persists and executes in the context of any user who visits an affected page, provided the installation is either a WordPress multisite deployment or a single-site instance with the unfiltered_html capability disabled. The CVSS v3.1 base score is 4.4 (Medium), reflecting the requirement for high-privilege authentication and specific configuration constraints.

Business impact

A compromised administrator account or insider threat could use this vulnerability to inject malicious scripts that steal user data, capture credentials, redirect visitors to phishing pages, or perform unauthorized actions on behalf of visitors. For organizations running multisite WordPress networks, a single compromised admin account could potentially affect multiple sites simultaneously. The impact is contained to stored XSS rather than site-wide compromise—an attacker cannot directly access the server or escalate privileges—but the ability to manipulate page content poses reputational and compliance risks, particularly for sites handling sensitive visitor data.

Affected systems

The Chatra Live Chat + ChatBot + Cart Saver plugin in versions up to and including 1.0.12 is affected. Vulnerability only manifests in WordPress multisite installations or single-site installations where the unfiltered_html user capability has been disabled (a common hardening measure). Standard WordPress single-site installations where administrators have the unfiltered_html capability enabled are not affected, as WordPress's core editor will sanitize the content before storage.

Exploitability

Exploitation requires authentication as an administrator or higher-privileged user and is not remotely exploitable by unauthenticated attackers. The attacker must have direct access to the WordPress admin panel and knowledge of the plugin's settings interface. The vulnerability does not appear on the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating no active exploitation in the wild has been publicly reported. However, the barrier to exploitation is relatively low for any attacker who has already compromised or been granted administrative credentials.

Remediation

Update the Chatra Live Chat + ChatBot + Cart Saver plugin to a version newer than 1.0.12 that includes input sanitization and output escaping fixes. Verify the patched version against the official Chatra plugin repository or vendor advisory. Until patching is possible, restrict administrative access to trusted personnel only and monitor admin activity logs for suspicious plugin setting changes. Additionally, ensure unfiltered_html capability is appropriately scoped in your WordPress user roles.

Patch guidance

Check the official WordPress Plugin Directory or Chatra's support channels for a patched version of the plugin released after 1.0.12. Apply the update to all WordPress installations running the affected plugin, prioritizing multisite networks and single-site instances with unfiltered_html disabled. After updating, verify that the plugin's admin settings no longer accept or render raw HTML or JavaScript input. Test in a staging environment first to ensure compatibility with your site configuration and other installed plugins.

Detection guidance

Monitor WordPress admin audit logs and database activity for changes to the Chatra plugin settings. Search the WordPress wp_options or wp_postmeta tables for suspicious script tags (e.g., <script>, javascript:, onerror=) in plugin configuration values if you suspect compromise. Use WordPress security plugins with admin activity logging and integrity monitoring to flag unauthorized changes to plugin settings. Review stored XSS patterns in web application firewall (WAF) logs if available. Inspect the page source of public-facing pages for unexpected inline script tags or event handlers that do not appear in your site's legitimate templates.

Why prioritize this

While the CVSS score of 4.4 places this in the Medium severity tier, prioritization should consider your specific WordPress architecture and administrative access controls. Multisite network operators should treat this with higher urgency given the potential for cross-site impact. Single-site installations with unfiltered_html enabled face minimal risk. The requirement for admin-level authentication significantly limits real-world exposure compared to unauthenticated vulnerabilities, but the persistence of stored XSS makes this a business continuity concern if your admin tier has been compromised or contains unvetted users.

Risk score, explained

The CVSS v3.1 score of 4.4 reflects a Medium severity vulnerability because it requires high-privilege authentication (PR:H), has complex attack conditions (AC:H due to specific WordPress configurations), and delivers limited impact scope (CWE-79 XSS typically does not directly compromise confidentiality, integrity, or availability at the system level). The attack is confined to the web application context and does not grant remote code execution or server-level access. However, the changed scope (S:C in the vector) indicates potential impact across security boundaries in a multisite context, which partially offsets the low authentication barrier within that scope.

Frequently asked questions