CVE-2025-1450 Overview
CVE-2025-1450 is a stored Cross-Site Scripting (XSS) vulnerability in the Chaty plugin for WordPress, developed by Premio. The plugin, marketed as Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button, WhatsApp, is vulnerable through the data-hover parameter in all versions up to and including 3.3.5. The flaw stems from insufficient input sanitization and output escaping [CWE-79]. Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript that executes when users visit affected pages.
Critical Impact
Contributor-level attackers can persist malicious JavaScript that executes in visitors' browsers, enabling session theft, redirect chains, and defacement across WordPress sites running Chaty 3.3.5 or earlier.
Affected Products
- Premio Chaty (Floating Chat Widget) plugin for WordPress, versions up to and including 3.3.5
- WordPress sites that permit Contributor-level user registration
- Any site rendering content that includes the vulnerable data-hover attribute handler
Discovery Timeline
- 2025-02-27 - CVE-2025-1450 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-1450
Vulnerability Analysis
The Chaty plugin renders user-controlled data from the data-hover attribute inside the front-end script cht-front-script.js. Input passed through this attribute is neither sanitized on storage nor escaped on output. An authenticated attacker with Contributor privileges can embed markup or shortcodes that place attacker-controlled values into data-hover. When a visitor loads the affected page, the injected script executes in their browser under the site's origin.
Because the payload is stored, exploitation does not require social engineering beyond normal page visits. Successful execution can hijack sessions, exfiltrate cookies for accounts without HttpOnly, perform actions on behalf of authenticated administrators, or pivot to full site takeover if an admin loads the page.
Root Cause
The root cause is missing input sanitization and missing output escaping around the data-hover parameter in the Chaty front-end handler. The vulnerable logic in js/cht-front-script.js at approximately line 389 processes the attribute value without treating it as untrusted content. This is a classic [CWE-79] failure where server-side storage and client-side rendering both trust attacker-supplied strings.
Attack Vector
Exploitation requires an authenticated account at Contributor level or above and user interaction from a visitor loading the injected page. The attack executes over the network with low complexity. Because the vulnerability is stored, a single injection persists until the content is removed. Refer to the Wordfence Threat Intelligence Report and the WordPress Chaty Script Version 3.3.4 source for the vulnerable code path.
Detection Methods for CVE-2025-1450
Indicators of Compromise
- Post or page content containing data-hover attributes with <script> tags, javascript: URIs, or event handlers such as onerror and onclick
- New or modified Contributor-level accounts on WordPress installations running Chaty 3.3.5 or earlier
- Outbound browser requests from site visitors to unknown domains initiated after page load of Chaty-enabled pages
- Unexpected administrator actions originating from browser sessions rather than direct logins
Detection Strategies
- Scan the wp_posts table for data-hover attribute values containing HTML control characters, script tags, or encoded JavaScript payloads
- Monitor WordPress audit logs for content edits by Contributor and Author accounts on pages that render the Chaty widget
- Use browser-side Content Security Policy (CSP) reports to identify inline script violations on pages using Chaty
Monitoring Recommendations
- Alert on creation of Contributor accounts followed by content edits within a short time window
- Log and review all changes to plugin files under wp-content/plugins/chaty/
- Correlate visitor telemetry with page URLs known to include Chaty widget markup to identify anomalous script execution
How to Mitigate CVE-2025-1450
Immediate Actions Required
- Update the Chaty plugin to the patched version released after 3.3.5 as tracked in WordPress Changeset #3246336
- Audit all posts and pages for suspicious data-hover attribute content and remove injected payloads
- Review Contributor, Author, and Editor accounts, removing any that are unrecognized or inactive
- Rotate administrator session cookies and credentials if injected content is discovered
Patch Information
Premio addressed the vulnerability in WordPress Changeset #3246336, which introduces proper sanitization and output escaping for the data-hover parameter. Site operators should upgrade to the first Chaty release that includes this changeset. The minified script at Chaty 3.3.5 minified script reflects the unpatched behavior for comparison.
Workarounds
- Restrict user registration and prevent untrusted users from receiving Contributor or higher roles until patching is complete
- Deploy a Web Application Firewall (WAF) rule that blocks requests containing data-hover attribute values with <, >, or javascript: sequences
- Enforce a strict Content Security Policy that disallows inline scripts on pages rendering the Chaty widget
- Temporarily deactivate the Chaty plugin on sites that cannot immediately upgrade
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.