CVE-2026-7795: Click to Chat WA Widget WordPress Plugin Stored XSS Vulnerability (v4.38)

Technical summary

CVE-2026-7795 is a Stored Cross-Site Scripting (XSS) vulnerability in the Click to Chat – WA Widget plugin versions up to 4.38. The vulnerability exists in the CCW_Shortcode::shortcode() function, which processes the [chat] shortcode's 'num' parameter. The function applies esc_attr() to escape the parameter for HTML attribute context (converting single quotes to '), but this escaped value is then directly interpolated into a JavaScript window.open() call string delimited by single quotes. This composed string is subsequently placed verbatim into HTML onclick event-handler attributes in style template files. The flaw occurs because browsers HTML-decode event attribute values before executing embedded JavaScript, causing the HTML entities to be decoded back to literal quote characters at runtime. An attacker can exploit this double-layer processing to inject arbitrary JavaScript that breaks out of the string context and executes with the privileges of the logged-in user.

Business impact

This vulnerability enables low-privileged authenticated attackers (Contributor level and above) to persistently inject malicious scripts into pages containing the WhatsApp widget. When visitors interact with the chat button, the injected code executes in their browsers, potentially enabling credential theft, session hijacking, defacement, malware distribution, or redirection to phishing sites. Organizations relying on the Click to Chat plugin for customer engagement face reputational risk and potential customer data exposure. The attack requires no user interaction beyond the normal click-to-chat action, making it particularly dangerous in high-traffic scenarios.

Affected systems

The Click to Chat – WA Widget plugin for WordPress in all versions up to and including 4.38 is affected. Organizations using this plugin to embed WhatsApp messaging functionality on their WordPress sites are at risk. The vulnerability requires that an attacker have at least Contributor-level access to the WordPress installation, meaning the exposure is limited to environments where such accounts are provisioned. However, in multi-author or agency-managed WordPress setups, this permission level may be more widely distributed than assumed.

Exploitability

The vulnerability is moderately exploitable. While it requires authenticated access at the Contributor level or above, many WordPress installations grant such permissions to content creators, guest authors, or agency contractors. No special technical skills are needed beyond crafting a malicious shortcode attribute; the injection point is straightforward and does not require bypassing additional security controls. Once injected via the shortcode, the malicious script persists in the page and executes for all visitors, making it a high-impact attack with low execution complexity. The CVSS 3.1 score of 6.4 (MEDIUM severity) reflects the requirement for authenticated access and the lack of availability impact, but acknowledges the combination of integrity and confidentiality risk across site scope.

Remediation

Upgrade the Click to Chat – WA Widget plugin to a patched version that properly escapes or sanitizes the 'num' parameter for JavaScript string contexts. Verify the fix in the vendor's advisory to ensure the escaping mechanism accounts for both HTML and JavaScript decoding layers. In the interim, restrict Contributor-level access to only trusted team members, audit existing posts and pages containing the [chat] shortcode for injected payloads, and consider disabling the plugin if it is not actively needed. Review user access logs for any unauthorized shortcode insertions or edits to pages containing the widget.

Patch guidance

Check the plugin vendor's advisory and release notes for a patched version that addresses the escaping issue. The fix should either apply context-aware encoding that survives both HTML and JavaScript decoding, or refactor the code to avoid interpolating user input into JavaScript string literals within event handlers. After updating, test the WhatsApp chat functionality across multiple browsers to confirm the widget still operates correctly. Verify that any payloads matching the vulnerability pattern no longer execute by reviewing browser developer console output or injecting test patterns.

Detection guidance

Monitor the WordPress plugin directory and vendor release notes for security updates to Click to Chat – WA Widget. Audit the [chat] shortcode usage across all published posts and pages using WordPress plugin activity logs or database queries (search postmeta or post_content for shortcode instances). Examine any user edits made by Contributor-level accounts to pages containing the shortcode, particularly changes made around the 'num' parameter or surrounding attributes. Implement Web Application Firewall (WAF) rules to detect common XSS payloads in shortcode attributes, and monitor browser console errors for signs of injected JavaScript. In WordPress, enable and review security audit logs for any modifications to plugin files or post metadata.

Why prioritize this

While the CVSS score is MEDIUM (6.4), prioritize this vulnerability in mixed-access WordPress environments. The stored nature of the XSS, combined with the low bar to entry (Contributor permissions), means that a single compromised or malicious user account can silently inject code affecting all site visitors. This is particularly critical for e-commerce, SaaS, and agency-hosted WordPress sites where Contributor accounts are common. Organizations with strict access controls limiting Contributor permissions to a small, trusted team may deprioritize slightly, but should still patch promptly.

Risk score, explained

The CVSS 3.1 score of 6.4 reflects a MEDIUM-severity vulnerability. The score incorporates: (1) Network-accessible attack vector (AV:N), (2) Low attack complexity with no special conditions required (AC:L), (3) Requirement for low-privilege authenticated access (PR:L), (4) No user interaction needed from the attacker's perspective (UI:N), (5) Changed scope—the vulnerability can affect resources beyond the vulnerable component (S:C), and (6) Low confidentiality and integrity impact (C:L, I:L) with no availability impact (A:N). The score does not account for prevalence of plugin installations or the ease with which Contributor accounts may be provisioned in real-world WordPress deployments.

Frequently asked questions