Executive brief
The Social Chat – Click To Chat App Button is a WordPress plugin that enables website owners to embed chat functionality into their pages. A flaw allows authenticated contributors and above to inject malicious JavaScript code that will execute on every visitor's browser when they load an affected page. With the consent box set to auto-open on page load, the attack executes automatically without any user interaction, potentially compromising visitor data or website integrity.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the plugin's handling of the 'consent_message' JSON attribute within the .qlwapp data-box configuration. The vulnerability stems from insufficient input sanitization and output escaping when processing this field. An authenticated attacker with contributor-level access or higher can craft a malicious JSON payload that injects arbitrary JavaScript into the page content. By setting auto_open and consent_enabled to 'yes' in the injected data-box, the script executes automatically upon page load with no user interaction required. The flaw affects all versions up to and including 8.6.2. A patch is expected from the vendor.
Affected products
- WP Whatsapp Chat Social Chat - Click To Chat App Button up to and including 8.6.2
Timeline
- 2026-09-05: disclosed