Skip to content
OpenAdvisories

Vendor

holithemes

5 known vulnerabilities.

Products

Click to Chat – HoliThemes 4 WP SHAPES 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 6.4
    CVE-2026-7795

    Click to Chat <= 4.39 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'num' Shortcode Parameter

    The Click to Chat – WA Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the [chat] shortcode 'num' parameter in all versions up to, and including, 4.38. This is due to insufficient escaping when embedding user-supplied shortcode at…

    holithemes Click to Chat – HoliThemes Web / CMS
  • Medium 6.4
    CVE-2025-5336

    Click to Chat <= 4.22 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via data-no_number Parameter

    The Click to Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-no_number’ parameter in all versions up to, and including, 4.22 to insufficient input sanitization and output escaping. This makes it possible for authenticated …

    holithemes Click to Chat – HoliThemes Web / CMS
  • Medium 6.4
    CVE-2024-9619

    WP SHAPES <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

    The WP SHAPES plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wi…

    holithemes WP SHAPES Web / CMS