CVE-2026-92097criticalCWE-94

CVE-2026-92097: fallo crítico en holithemes Click to Chat – HoliThemes

Click to Chat <= 4.44 - Unauthenticated Arbitrary Shortcode Execution via REQUEST_URI via {url} Placeholder

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Click to Chat – HoliThemes

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9.1epss 0.5%
The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.44 This is due to the greetings_dialog() function building the {url} template placeholder from a sanitize_text_field()-filtered $_SERVER['REQUEST_URI'] on archive pages and then passing the substituted greeting content to do_shortcode() in the greetings-1 and greetings-2 templates, without stripping shortcode delimiters. Because wp_kses() runs against main_content BEFORE the {url} substitution, the attacker-controlled URL bytes reach do_shortcode() unfiltered. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes registered by WordPress core, the active theme, or any other plugin (e.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Productos afectados
holithemes · Click to Chat – HoliThemes
CVEs relacionadas — holithemes Click to Chat – HoliThemes

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-3849HIGHClick to Chat – HoliThemes <= 3.35 - Authenticated (Contributor+) Local File InclusionEPSS 1.7%CVE-2026-7795MEDIUMClick to Chat <= 4.39 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'num' Shortcode ParameterEPSS 0.4%CVE-2025-5336MEDIUMClick to Chat <= 4.22 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via data-no_number ParameterEPSS 0.3%