Chaty Pro Vulnerabilities

The Chaty Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.5.8. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user...

CVSS:

7.2

(Wordfence)

Affected:

up to 3.5.8

Fixed in:

3.5.9

Disclosed:

Aug 17, 2026

CVE-2026-73360 on NVD →

The Chaty Pro plugin for WordPress is vulnerable to Authenticated Time-Based Blind SQL Injection in versions up to and including 3.5.5. This is due to the fetch_custom_field() function in admin/class-admin-base.php retrieving the widget_id POST parameter via filter_input(INPUT_POST, ...) and directly concatenating the...

CVSS:

6.5

(Wordfence)

Affected:

up to 3.5.5

Fixed in:

3.5.6

Disclosed:

Jul 27, 2026

CVE-2026-6251 on NVD →

The Chaty Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 3.3.3. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

CVSS:

9.8

(Wordfence)

Affected:

up to 3.3.3

Fixed in:

3.3.4

Disclosed:

Feb 14, 2025

CVE-2025-26776 on NVD →