WordPress plugin
Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat – Bit Assist security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 9 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical1
- High0
- Medium8
- Low0
All Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat – Bit Assist vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium4.4 | Authenticated (Admin+) Stored Cross-Site Scripting ≤1.7.1Update to 1.7.2 | CVE-2026-39070 | |
| Critical9.8 | Unauthenticated Arbitrary File Upload ≤1.8.1Update to 1.8.2 | CVE-2026-16548 | |
| Medium5.3 | Missing Authorization ≤1.5.11Update to 1.6.0 | CVE-2025-68596 | |
| Medium5.8 | Unauthenticated Path Traversal ≤1.5.4Update to 1.5.5 | CVE-2025-30834 | |
| Medium6.5 | Path Traversal to Authenticated (Subscriber+) Arbitrary File Read via fileID Parameter ≤1.5.2Update to 1.5.3 | CVE-2025-0822 | |
| Medium4.9 | Path Traversal to Authenticated (Administrator+) Arbitrary File Read via downloadResponseFile Function ≤1.5.2Update to 1.5.3 | CVE-2024-13791 | |
| Medium6.5 | Authenticated (Subscriber+) SQL Injection via id Parameter ≤1.5.2Update to 1.5.3 | CVE-2025-0821 | |
| Medium4.4 | Authenticated (Administrator+) Stored Cross-Site Scripting <1.2Update to 1.2 | CVE-2023-51371 | |
| Medium4.4 | Authenticated (Administrator+) Stored Cross-Site Scripting ≤1.1.8Update to 1.1.9 | CVE-2023-3667 |
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤1.7.1Update to 1.7.2
- Critical9.8Unauthenticated Arbitrary File Upload
≤1.8.1Update to 1.8.2
- Medium5.3Missing Authorization
≤1.5.11Update to 1.6.0
- Medium5.8Unauthenticated Path Traversal
≤1.5.4Update to 1.5.5
- Medium6.5Path Traversal to Authenticated (Subscriber+) Arbitrary File Read via fileID Parameter
≤1.5.2Update to 1.5.3
- Medium4.9Path Traversal to Authenticated (Administrator+) Arbitrary File Read via downloadResponseFile Function
≤1.5.2Update to 1.5.3
- Medium6.5Authenticated (Subscriber+) SQL Injection via id Parameter
≤1.5.2Update to 1.5.3
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
<1.2Update to 1.2
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤1.1.8Update to 1.1.9
Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat – Bit Assist: common questions
Does Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat – Bit Assist have known vulnerabilities?
Yes. VulnCrest Radar lists 9 known vulnerabilities in Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat – Bit Assist: 1 critical, 8 medium. None are known to affect version null.
How do I check which version of Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat – Bit Assist I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat – Bit Assist vulnerability?
CVE-2026-39070, published Aug 28, 2026: Bit Assist <= 1.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting. Severity: Medium (CVSS 4.4).
Is any Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat – Bit Assist vulnerability listed in CISA KEV?
No. None of the known Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat – Bit Assist vulnerabilities is currently listed in the CISA KEV catalog.