blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-92097

CRITICAL 9.1 CVSS 3.1
Published
October 14, 2026
Last modified
October 15, 2026
NVD status
Deferred
Reported by
security@wordfence.com
Weakness
CWE-94
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Description

The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.44 This is due to the greetings_dialog() function building the {url} template placeholder from a sanitize_text_field()-filtered $_SERVER['REQUEST_URI'] on archive pages and then passing the substituted greeting content to do_shortcode() in the greetings-1 and greetings-2 templates, without stripping shortcode delimiters. Because wp_kses() runs against main_content BEFORE the {url} substitution, the attacker-controlled URL bytes reach do_shortcode() unfiltered. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes registered by WordPress core, the active theme, or any other plugin (e.

Affected WordPress components

  • Click to Chat – HoliThemes Plugin · click-to-chat-for-whatsapp
    Confirmed match Active
    Up to and including 4.44
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • holithemes Click to Chat – HoliThemes — Up to and including 4.44

References

  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/click-to-chat-for-whatsapp/tags/4.44/new/inc/greetings/class-ht-ctc-chat-greetings.php#L111
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/click-to-chat-for-whatsapp/tags/4.44/new/inc/greetings/class-ht-ctc-chat-greetings.php#L224
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/click-to-chat-for-whatsapp/tags/4.44/new/inc/greetings/greetings-1.php#L22
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/click-to-chat-for-whatsapp/tags/4.44/new/inc/greetings/greetings-2.php#L18
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/3716433/click-to-chat-for-whatsapp/trunk/new/inc/greetings/greetings-1.php
  • www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/cf625e34-1f51-42a3-8daa-a5188dea226e?source=cve
  • nvd.nist.gov Official NVD record