Description

Unauthenticated Cross Site Scripting (XSS) in Chaty Pro <= 3.5.8 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-18T15:17:04.360Z",
  "pubdate": "2026-08-18T15:17:04.360Z",
  "executiveSummary": "An unauthenticated Cross-Site Scripting (XSS) vulnerability has been identified in the Chaty Pro plugin across versions less than or equal to 3.5.8. This security flaw allows remote, unauthenticated attackers to inject malicious client-side scripts, typically JavaScript, into vulnerable web pages rendered by the application.\nThe primary impact of this vulnerability involves the potential compromise of user sessions, unauthorized execution of arbitrary script code within the context of a victim's browser, and potential redirection to malicious destinations. The affected systems include any WordPress installations utilizing the specified vulnerable versions of Chaty Pro.\nThe risk implication is significant as it requires no prior authentication or specialized privileges, lowering the attack barrier to external threat actors interacting directly over the network via standard HTTP requests.\nExploitation relies on the application's failure to properly sanitize or encode user-supplied input before reflecting it back to the client, enabling the execution of arbitrary scripts whenever an unsuspecting user accesses the compromised endpoint.",
  "technicalDetails": "The root cause of the vulnerability stems from inadequate input validation and output encoding within the Chaty Pro codebase for versions <= 3.5.8. Specifically, parameters handled by the application fail to undergo context-aware sanitization, allowing malicious payloads to be injected directly into the DOM.\nThe vulnerability is exposed over the network via standard web protocols (HTTP/HTTPS) and can be triggered without authentication or user privileges. An attacker crafts a malicious URL containing an encoded JavaScript payload designed to exploit the lack of input sanitization in the vulnerable component.\nThe attack flow proceeds as follows: First, the unauthenticated attacker identifies a vulnerable parameter or input vector handled by Chaty Pro. Second, the attacker crafts a malicious payload containing executable JavaScript. Third, the attacker delivers this payload to the target via a crafted link or direct HTTP request to the vulnerable endpoint.\nUpon receiving the request, the server processes the input and unsafely reflects it within the HTTP response without proper HTML or JavaScript encoding. When a victim's browser parses the response, the injected script executes within the security context of the victim's session.\nThe payload behavior includes executing arbitrary JavaScript in the victim's browser, which can lead to session hijacking via cookie theft, DOM manipulation, keylogging, or performing unauthorized actions on behalf of the authenticated user. The post-exploitation impact depends on the privileges of the victim interacting with the injected content, potentially granting attackers administrative access if an administrator views the malicious payload."
}