CVE-2026-15759 Overview
CVE-2026-15759 is a Stored Cross-Site Scripting (XSS) vulnerability in the ChatHelp – Click to Chat Button, WooCommerce Chat to Order & Floating Chat Form plugin for WordPress. The flaw affects all versions up to and including 3.5.1. It stems from insufficient input sanitization and output escaping on the number and group shortcode attributes. Authenticated users with contributor-level access or higher can inject arbitrary JavaScript into pages. The injected script executes in the browser of any visitor who loads the affected page. The vulnerability is tracked as [CWE-79] and was catalogued in the Wordfence Vulnerability Analysis.
Critical Impact
Authenticated contributors can inject persistent JavaScript that runs against any visitor, enabling session theft, admin account takeover, and drive-by redirection.
Affected Products
- ChatHelp – Click to Chat Button plugin for WordPress (versions ≤ 3.5.1)
- WooCommerce Chat to Order integration provided by ChatHelp (versions ≤ 3.5.1)
- Floating Chat Form component of ChatHelp (versions ≤ 3.5.1)
Discovery Timeline
- 2026-07-17 - CVE-2026-15759 published to NVD
- 2026-07-17 - Last updated in NVD database
Technical Details for CVE-2026-15759
Vulnerability Analysis
The ChatHelp plugin exposes a shortcode that renders chat buttons based on attributes controlled by the content author. Two of these attributes, number and group, are echoed into HTML output without adequate sanitization or escaping. A contributor can craft a post containing the shortcode with a payload embedded in either attribute. When the post is rendered, the payload becomes part of the page markup and executes in the visitor's browser. Because contributors can submit posts for review, an editor or administrator previewing the post will trigger the payload under their session context. Successful exploitation enables cookie theft, forced administrative actions through the WordPress REST API, and injection of malicious redirects.
Root Cause
The vulnerable code paths are located in the plugin's shortcode rendering logic, specifically in CustomButtonsTemplates.php and CustomShortcode.php. Attribute values passed from the shortcode parser reach the template layer and are concatenated into HTML without functions such as esc_attr() or esc_html(). See the WordPress Chat Help Template Code and the WordPress Custom Shortcode Code for the affected sinks.
Attack Vector
The attack is network-based and requires low-privileged authentication. An attacker registers or compromises a contributor account, then publishes or submits a post containing a ChatHelp shortcode with a JavaScript payload in the number or group attribute. Any authenticated or unauthenticated user who subsequently loads the page executes the payload in the origin of the WordPress site. No user interaction beyond page navigation is required.
// Conceptual payload structure - do not use
[chat-help number="<script-payload-in-attribute>" group="..."]
// The attribute value is echoed into the rendered HTML without escaping,
// breaking out of the attribute context and executing in the visitor's browser.
Detection Methods for CVE-2026-15759
Indicators of Compromise
- Post or page content containing ChatHelp shortcodes where the number or group attributes include angle brackets, javascript: URIs, or HTML event handlers such as onerror and onclick.
- Unexpected outbound requests from visitor browsers to attacker-controlled domains originating from pages that embed the ChatHelp shortcode.
- Creation of new administrator accounts or changes to WordPress options shortly after an editor previews a contributor-submitted post.
Detection Strategies
- Query the wp_posts table for post_content values matching the ChatHelp shortcode pattern combined with suspicious characters in the number or group attributes.
- Inspect rendered HTML of pages containing the shortcode for <script> tags or event handler attributes that were not authored intentionally.
- Review WordPress user roles and recent contributor activity for accounts created before the exploitation window.
Monitoring Recommendations
- Enable web server and WordPress audit logging to capture post creation and update events by contributor-level accounts.
- Deploy a web application firewall rule that inspects shortcode attribute values for HTML metacharacters and known XSS payload signatures.
- Alert on Content Security Policy violation reports from front-end pages that host the ChatHelp shortcode.
How to Mitigate CVE-2026-15759
Immediate Actions Required
- Update the ChatHelp plugin to a version later than 3.5.1 as soon as the vendor publishes a fixed release referenced in the WordPress Chat Help Changeset.
- Audit all posts and pages containing the ChatHelp shortcode and remove any suspicious number or group attribute values.
- Review contributor and author accounts, revoke unused access, and require strong authentication for content editors.
Patch Information
A plugin changeset addressing the sanitization gap has been recorded in the WordPress plugin repository. Administrators should upgrade to the latest ChatHelp release published after version 3.5.1 and confirm the fix is present by validating that number and group attributes are escaped in the rendered output. Refer to the Wordfence Vulnerability Analysis for the confirmed fixed version.
Workarounds
- Temporarily deactivate the ChatHelp plugin until the patched version is installed.
- Restrict the use of the ChatHelp shortcode to trusted roles by removing contributor-level content submission permissions.
- Deploy a Content Security Policy that disallows inline scripts to reduce the impact of any residual injection.
# Disable the ChatHelp plugin via WP-CLI while a patch is validated
wp plugin deactivate chat-help
# Search post content for potentially malicious shortcode usage
wp db query "SELECT ID, post_title FROM wp_posts \
WHERE post_content REGEXP 'chat-help[^]]*(<|javascript:|on[a-z]+=)'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
