WordPress plugin
OneClick Chat to Order security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 6 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High1
- Medium4
- Low1
All OneClick Chat to Order vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Low2.7 | Missing Authorization to Authenticated (Editor+) Plugin Settings Update ≤1.0.9Update to 1.1.0 | CVE-2025-14270 | |
| High7.5 | Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure ≤1.0.8Update to 1.0.9 | CVE-2025-13526 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting ≤1.0.5Update to 1.0.6 | CVE-2024-29789 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤1.0.5Update to 1.0.6 | — | |
| Medium4.4 | Authenticated (Administrator+) Stored Cross-Site Scripting ≤1.0.4.2Update to 1.0.5 | CVE-2023-47546 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤1.0.4.1Update to 1.0.4.2 | CVE-2022-4760 |
- Low2.7Missing Authorization to Authenticated (Editor+) Plugin Settings Update
≤1.0.9Update to 1.1.0
- High7.5Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure
≤1.0.8Update to 1.0.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.0.5Update to 1.0.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
≤1.0.5Update to 1.0.6
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤1.0.4.2Update to 1.0.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
≤1.0.4.1Update to 1.0.4.2
OneClick Chat to Order: common questions
Does OneClick Chat to Order have known vulnerabilities?
Yes. VulnCrest Radar lists 6 known vulnerabilities in OneClick Chat to Order: 1 high, 4 medium, 1 low. None are known to affect version null.
How do I check which version of OneClick Chat to Order I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent OneClick Chat to Order vulnerability?
CVE-2025-14270, published Feb 18, 2026: OneClick Chat to Order <= 1.0.9 - Missing Authorization to Authenticated (Editor+) Plugin Settings Update. Severity: Low (CVSS 2.7).
Is any OneClick Chat to Order vulnerability listed in CISA KEV?
No. None of the known OneClick Chat to Order vulnerabilities is currently listed in the CISA KEV catalog.