Vulnerabilities and security researches forchat-help chat-help

Jul 19, 2026

CVE, Research URL: CVE-2026-15759
Home page URL: Security reports for Better Chat Support – Chat Bubble and Chat Button with Gutenberg, Elementor and Shortcode
Application: Better Chat Support – Chat Bubble and Chat Button with Gutenberg, Elementor and Shortcode
Date: Jul 17, 2026
Research Description: The ChatHelp – Click to Chat Button, WooCommerce Chat to Order & Floating Chat Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'number' and 'group' Shortcode Attributes in all versions up to, and including, 3.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions: max 3.5.2.
Status: vulnerable

Jul 13, 2026

CVE, Research URL: CVE-2026-15291
Home page URL: Security reports for Better Chat Support – Chat Bubble and Chat Button with Gutenberg, Elementor and Shortcode
Application: Better Chat Support – Chat Bubble and Chat Button with Gutenberg, Elementor and Shortcode
Date: Jul 10, 2026
Research Description: The Chat Help – Click to Chat Button & Form plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.3 via the REST API endpoints /wp-json/chat-help/v1/leads and /wp-json/chat-help/v1/leads/{id}. This is due to the plugin not performing any authentication and authorization checks. This makes it possible for unauthenticated attackers to extract sensitive data including customer names, email addresses, phone numbers, WhatsApp messages, complete geolocation data (IP addresses, city, country, ISP, coordinates), device fingerprinting information (browser, OS, screen resolution), and WordPress account credentials (user IDs, usernames, emails, names) for logged-in users who submit forms.
Affected versions: max 3.1.4.
Status: vulnerable

Jun 16, 2026

CVE, Research URL: 8a411eca22d919bf26ed921fa3f1bd25a1ede1c6
Home page URL: Security reports for Better Chat Support – Chat Bubble and Chat Button with Gutenberg, Elementor and Shortcode
Application: Better Chat Support – Chat Bubble and Chat Button with Gutenberg, Elementor and Shortcode
Date: Nov 18, 2025
Research Description: ChatHelp – Click to Chat Button, Chat to Order, Floating Chat & Form [chat-help] < 3.1.4 Chat Help – Click to Chat Button & Form <= 3.1.3 - Missing Authorization to Unauthenticated Sensitive Information Exposure The Chat Help – Click to Chat Button & Form plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.3 via the REST API endpoints /wp-json/chat-help/v1/leads and /wp-json/chat-help/v1/leads/{id}. This is due to the plugin not performing any authentication and authorization checks. This makes it possible for unauthenticated attackers to extract sensitive data including customer names, email addresses, phone numbers, WhatsApp messages, complete geolocation data (IP addresses, city, country, ISP, coordinates), device fingerprinting information (browser, OS, screen resolution), and WordPress account credentials (user IDs, usernames, emails, names) for logged-in users who submit forms.
Affected versions: max 3.1.4.
Status: vulnerable

Dec 11, 2025

CVE, Research URL: CVE-2025-66099
Home page URL: Security reports for Better Chat Support – Chat Bubble and Chat Button with Gutenberg, Elementor and Shortcode
Application: Better Chat Support – Chat Bubble and Chat Button with Gutenberg, Elementor and Shortcode
Date: Nov 21, 2025
Research Description: Missing Authorization vulnerability in ThemeAtelier Chat Help chat-help allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Chat Help: from n/a through <= 3.1.3.
Affected versions: max 3.1.4.
Status: vulnerable

Jun 07, 2024

CVE, Research URL: CVE-2024-32110
Home page URL: Security reports for Better Chat Support – Chat Bubble and Chat Button with Gutenberg, Elementor and Shortcode
Application: Better Chat Support – Chat Bubble and Chat Button with Gutenberg, Elementor and Shortcode
Date: Jun 11, 2026
Research Description: Cross-Site request forgery (CSRF) vulnerability in Magepeople inc. WpEvently allows Cross Site Request Forgery. This issue affects WpEvently: from n/a through 4.1.2.
Affected versions: max 1.6.0.
Status: vulnerable