plugin
13 known security issues reported for the Wise Chat WordPress plugin. Most recent disclosed Aug 18, 2026.
Running Wise Chat on your site? Check whether your installed version is affected.
Scan your site freeThe Wise Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.4. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in p...
The Wise Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the X-Forwarded-For header in all versions up to, and including, 3.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will e...
[en] The Wise Chat plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.3 via the 'uploads' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads directory which can contain file at...
The Wise Chat plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.3 via the 'uploads' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads directory which can contain file attachm...
[en] Cross-Site Request Forgery (CSRF) vulnerability in Kainex Wise Chat.This issue affects Wise Chat: from n/a through 3.1.3.
The Wise Chat plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.1.3. This is due to missing nonce validation on several functions such as resetAnonymousCounterAction, resetSettingsAction, deleteAllUsersAndMessagesAction, deleteBanAction, addBanAction, clearChannelActio...
The Wise Chat plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 2.8.3. This allows unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configurati...
CSV Injection vulnerability found by Vishnupriya Ilango (Fortinet's FortiGuard Labs) in WordPress Wise Chat plugin (versions <= 2.8.3).
The Wise Chat plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 2.8.3. This allows unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configurati...
The Wise Chat plugin for WordPress is vulnerable to Reverse Tabnabbing in versions up to, and including, 2.6.3. This is due to mishandling of external links due to omitting noopener and noreferrer. This makes it possible for a chat-using attacker to provide a link that opens a new tab while silently redirecting the ori...
[en] The Wise Chat plugin before 2.7 for WordPress mishandles external links because rendering/filters/post/WiseChatLinksPostFilter.php omits noopener and noreferrer.
It could allow an unauthenticated or low privileges user to inject a command in chat messages that will be included in the exported CSV file (via message backup), leading to possible code execution.
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free