Social Chat <= 8.6.2 — Authenticated (Contributor+) Stored Cross-Site Scripting via 'consent_message' JSON Attribute in .qlwapp data-box

Am I affected?

• Check your version: in wp-admin go to Plugins → Installed Plugins and read the version under Social Chat – Click To Chat App Button.
• No admin access? Run a passive check of your site. It reads public files only.

What to do

1. Update to version 8.6.3, or a newer patched version
2. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.
3. Watch Social Chat – Click To Chat App Button to get an email when the next vulnerability is published.

Advisory

Source description from Wordfence Intelligence, credited to suyoung kim(AhnLab).

The Social Chat – Click To Chat App Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'consent_message' JSON Attribute in .qlwapp data-box in all versions up to, and including, 8.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit requires no user interaction beyond page load, as setting auto_open and consent_enabled to 'yes' in the injected data-box JSON causes the consent box — and the embedded script — to execute immediately on page load.

Exploits & references

Proof-of-concept & detection

No public proof-of-concept or detection template is known for this vulnerability.

Advisories & patches

• Advisorywordfence.com

Related CVEs

Timeline

1. Sep 4, 2026

   CVE published

   Severity medium, CVSS 6.4

2. Nov 13, 2026

   Record last updated