Click to Chat – HoliThemes <= 4.44 - Unauthenticated Arbitrary Shortcode Execution via Greetings Dialog Placeholders
- ID
- WPSEC-2026-0239
- Plugin
- Click to Chat – HoliThemes (click-to-chat-for-whatsapp)
- Affected
- all versions before 4.45
- Remediation
- Update to 4.45 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-94
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-22
- Attack surface
- Click to Chat – HoliThemes on WPSec AttackSurface
- Fix released
- Published
Also published later by Wordfence as CVE-2026-92097, on 2026-10-13.
Description
The Click to Chat – HoliThemes plugin for WordPress is vulnerable to Arbitrary Shortcode Execution via the greetings dialog in all versions up to, and including, 4.44. The {url} and {title} placeholders are substituted into the greetings main content before the greetings templates run do_shortcode() on it. On archive pages {url} is built from the request host and URI, which are only passed through sanitize_text_field, and {title} is the archive title, which on an author archive is the user's display name. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes by adding shortcode syntax to the query string of an archive page URL when the main content uses {url}. Authenticated attackers with subscriber-level access can also put shortcode syntax in their display name, which is then executed for every visitor of their author archive page with the default main content, which uses {title}. Exploitation requires the greetings dialog to be enabled, which it is not by default.
References
- https://wpsec.com/vuln/WPSEC-2026-0239/
- https://plugins.svn.wordpress.org/click-to-chat-for-whatsapp/tags/4.45/
- https://wordpress.org/plugins/click-to-chat-for-whatsapp/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS