Executive brief
The Chaty plugin for WordPress is a contact widget that allows businesses to add chat and communication options (Telegram, WhatsApp, WeChat, email, SMS, etc.) to their website. An unauthenticated attacker can inject arbitrary JavaScript code by crafting a malicious link; if a user visits that link, the injected script executes in their browser, potentially allowing the attacker to steal session tokens, modify page content, or redirect users to phishing sites.
Technical details
The vulnerability is a Reflected Cross-Site Scripting (XSS) flaw in the 's' URL parameter affecting all versions up to and including 3.5.9. The root cause is insufficient input sanitization and output escaping in the plugin's JavaScript. The plugin uses jQuery's .text() method to read document.title, which decodes HTML entities at the DOM level, bypassing WordPress's server-side HTML encoding. The decoded special characters are then embedded unescaped into an HTML attribute value, allowing arbitrary JavaScript injection. No authentication is required; the attack is triggered when an unauthenticated user clicks a malicious link. An attacker can inject arbitrary web scripts that execute in the victim's browser with the privileges of the page visitor.
Affected products
- WordPress Chaty up to and including 3.5.9
Timeline
- 2026-09-11: disclosed