CVE-2025-5336 Overview
CVE-2025-5336 is a Stored Cross-Site Scripting (XSS) vulnerability in the Click to Chat plugin for WordPress. The flaw affects all plugin versions up to and including 4.22. It stems from insufficient input sanitization and output escaping on the data-no_number parameter. Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript into pages. The injected script executes whenever a user views the affected page, enabling session theft, redirection, and further client-side attacks against site visitors and administrators. The vulnerability is classified under CWE-79.
Critical Impact
Authenticated contributors can persist JavaScript payloads that execute in the browsers of any user who views the injected content, including higher-privileged administrators.
Affected Products
- Click to Chat plugin for WordPress, versions up to and including 4.22
- WordPress sites using the click-to-chat-for-whatsapp plugin
- Sites permitting Contributor-level or higher account registration
Discovery Timeline
- 2025-06-14 - CVE-2025-5336 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-5336
Vulnerability Analysis
The Click to Chat plugin renders the data-no_number attribute into page markup without applying adequate sanitization or output escaping. Attackers with Contributor-level access can supply a crafted value for this parameter through the plugin's post or page editor interface. When the resulting page is rendered, the malicious payload executes in the browser context of the visitor.
Because the injection is stored in the database, the payload persists across page loads. Any authenticated user, including editors and administrators, is exposed when viewing the compromised content. The scope-change indicator in the CVSS vector reflects the ability to affect resources beyond the attacker's original privilege boundary.
Root Cause
The root cause is a failure to sanitize input on the data-no_number parameter and a lack of contextual output escaping when the value is rendered into HTML. The plugin's front-end JavaScript reads this attribute during rendering, so unescaped values are interpreted as executable script or attribute-breaking content. Details of the affected code paths are visible in the plugin source at line 126 and line 818. The fix is committed in WordPress Changeset #3309693.
Attack Vector
Exploitation requires authenticated access at Contributor level or above. The attacker submits a post or shortcode containing a malicious data-no_number value. The value is stored in the WordPress database and later rendered on the front end, where the injected script executes in the browser of anyone viewing the page. No user interaction beyond page navigation is required.
See the Wordfence Vulnerability Analysis for additional technical context on the injection surface.
Detection Methods for CVE-2025-5336
Indicators of Compromise
- Unexpected <script> tags, event handlers, or javascript: URIs stored in wp_posts content columns
- New or modified posts authored by Contributor-level accounts containing data-no_number attributes with non-numeric values
- Outbound requests from visitor browsers to unfamiliar domains after rendering plugin shortcodes
Detection Strategies
- Query the WordPress database for post content containing data-no_number values that include HTML-significant characters such as <, >, or "
- Review WordPress audit logs for post revisions submitted by Contributor accounts that reference the Click to Chat plugin
- Deploy a Web Application Firewall rule to flag POST requests to wp-admin/post.php containing script-like payloads in plugin parameters
Monitoring Recommendations
- Alert on unusual JavaScript execution patterns and outbound beaconing originating from public WordPress pages
- Track creation of Contributor and Author accounts, especially self-registered accounts on sites with open registration
- Correlate administrator session anomalies with recent content edits by low-privilege users
How to Mitigate CVE-2025-5336
Immediate Actions Required
- Update the Click to Chat plugin to the version containing Changeset #3309693, released after 4.22
- Audit all posts and pages using the plugin for suspicious data-no_number values and remove injected content
- Review Contributor, Author, and Editor accounts for legitimacy and rotate credentials where warranted
Patch Information
The plugin vendor has committed a fix in the plugin repository. Site administrators should install the latest release published on the WordPress plugin page. Verify the installed version through the WordPress admin Plugins screen after updating.
Workarounds
- Restrict Contributor and Author registration on public WordPress sites until the plugin is patched
- Disable the Click to Chat plugin if an immediate update is not possible
- Deploy a Content Security Policy that restricts inline script execution to reduce the impact of stored XSS payloads
# Update the Click to Chat plugin via WP-CLI
wp plugin update click-to-chat-for-whatsapp
wp plugin get click-to-chat-for-whatsapp --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
