premio Chaty vulnerabilities

Latest premio Chaty CVEs

Newest publication first

1. CVE-2026-27370 WordPress Chaty plugin <= 3.5.1 - Sensitive Data Exposure vulnerability

   Published 2026-03-05

   High·CVSS 7.5 EPSS 0.35%

   Insertion of Sensitive Information Into Sent Data vulnerability in Premio Chaty chaty allows Retrieve Embedded Sensitive Data.This issue affects Chaty: from n/a through <= 3.5.1.

2. CVE-2024-4149 Floating Chat Widget < 3.2.3 - Admin+ Stored XSS

   Published 2024-06-13

   Medium·CVSS 4.8 EPSS 0.43%

   The Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button WordPress plugin before 3.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Sit...

3. CVE-2023-47759 WordPress Chaty plugin <= 3.1.2 - Cross Site Scripting (XSS) vulnerability

   Published 2023-11-22

   Medium·CVSS 4.8 EPSS 0.40%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Premio Chaty chaty allows DOM-Based XSS.This issue affects Chaty: from n/a through <= 3.1.2.

4. CVE-2023-25019 WordPress Chaty Plugin <= 3.0.9 is vulnerable to Cross Site Scripting (XSS)

   Published 2023-08-30

   Medium·CVSS 6.1 EPSS 0.40%

   Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Premio Chaty plugin <= 3.0.9 versions

5. CVE-2023-3245 Floating Chat Widget < 3.1.2 - Admin+ Stored Cross-Site Scripting

   Published 2023-07-17

   Medium·CVSS 4.8 EPSS 0.46%

   The Floating Chat Widget WordPress plugin before 3.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in mul...

6. CVE-2022-3858 Chaty < 3.0.3 - Admin+ SQLi

   Published 2022-12-05

   High·CVSS 7.2 EPSS 1.1%

   The Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line, WeChat, Email, SMS, Call Button WordPress plugin before 3.0.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as lo...

7. CVE-2021-36846 WordPress Chaty plugin <= 2.8.3 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

   Published 2022-04-11

   Medium·CVSS 4.8 EPSS 0.60%

   Authenticated (admin or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Premio Chaty (WordPress plugin) <= 2.8.3

8. CVE-2021-25016 Chaty < 2.8.3 - Reflected Cross-Site Scripting

   Published 2022-01-03

   Medium·CVSS 6.1 EPSS 1.8%

   The Chaty WordPress plugin before 2.8.3 and Chaty Pro WordPress plugin before 2.8.2 do not sanitise and escape the search parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.