blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2021-25016

MEDIUM 6.1 CVSS 3.1
Published
January 3, 2022
Last modified
June 17, 2026
NVD status
Modified
Reported by
contact@wpscan.com
Weakness
CWE-79
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Description

The Chaty WordPress plugin before 2.8.3 and Chaty Pro WordPress plugin before 2.8.2 do not sanitise and escape the search parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting

Affected WordPress components

  • Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty Plugin · chaty
    Confirmed match Active
    From 2.8.3 (including) to 2.8.3 (excluding); Before 2.8.3
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • Unknown Floating Chat Widget: Contact Icons, Messages, Telegram, Email, SMS, Call Button – Chaty — From 2.8.3 (including) to 2.8.3 (excluding)
  • Unknown Floating Chat Widget Pro - Chaty Pro — From 2.8.2 (including) to 2.8.2 (excluding)
  • premio chaty — Before 2.8.3
  • premio chaty_pro — Before 2.8.2

References

  • wpscan.com https://wpscan.com/vulnerability/b5035987-6227-4fc6-bc45-1e8016e5c4c0 Exploit, Third Party Advisory
  • nvd.nist.gov Official NVD record