Atomchat Vulnerabilities

The Group Chat & Video Chat by AtomChat plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'atomchat_update_auth_ajax' and 'atomchat_update_layout_ajax' functions in all versions up to, and including, 1.1.7 This makes it possible for authenticated attackers,...

CVSS:

4.3

Affected:

up to 1.1.7

Fixed in:

1.1.8

Disclosed:

Mar 20, 2026

CVE-2026-1253 on NVD →

The Group Chat & Video Chat by AtomChat plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.1.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.

CVSS:

4.3

Affected:

up to 1.1.7

Fixed in:

1.1.8

Disclosed:

Apr 1, 2025

CVE-2025-31831 on NVD →

[en] Missing Authorization vulnerability in Team AtomChat AtomChat allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects AtomChat: from n/a through 1.1.6.

Affected:

up to 1.1.6

Fix:

No patched version reported

Disclosed:

Apr 1, 2025

CVE-2025-31831 on NVD →

The AtomChat plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that wi...

CVSS:

6.4

Affected:

up to 1.1.6

Fix:

No patched version reported

Disclosed:

Mar 31, 2025

CVE-2025-31532 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Team AtomChat AtomChat allows Stored XSS. This issue affects AtomChat: from n/a through 1.1.6.

Affected:

up to 1.1.6

Fix:

No patched version reported

Disclosed:

Mar 31, 2025

CVE-2025-31532 on NVD →

[en] Missing Authorization vulnerability in AtomChat AtomChat allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AtomChat: from n/a through 1.1.4.

Affected:

up to 1.1.5

Fixed in:

1.1.5

Disclosed:

Jan 2, 2025

CVE-2023-46606 on NVD →

[en] The Group Chat & Video Chat by AtomChat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's atomchat shortcode in all versions up to, and including, 1.1.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

Affected:

up to 1.1.6

Fixed in:

1.1.6

Disclosed:

Nov 1, 2024

CVE-2024-10232 on NVD →

The Group Chat & Video Chat by AtomChat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's atomchat shortcode in all versions up to, and including, 1.1.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attac...

CVSS:

6.4

Affected:

up to 1.1.5

Fixed in:

1.1.6

Disclosed:

Oct 31, 2024

CVE-2024-10232 on NVD →

The AtomChat plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'credits' REST API function in versions up to, and including, 1.1.4. This makes it possible for unauthenticated attackers to manipulate user credits when the myCred plugin is installed.

CVSS:

5.3

Affected:

up to 1.1.4

Fixed in:

1.1.5

Disclosed:

Oct 24, 2023

CVE-2023-46606 on NVD →