CVE-2026-18404: WordPress Social Chat Plugin XSS Vulnerability

CVE-2026-18404 Overview

CVE-2026-18404 is a stored Cross-Site Scripting (XSS) vulnerability in the Social Chat – Click To Chat App Button plugin for WordPress. The flaw affects all versions up to and including 8.6.2. It stems from insufficient input sanitization and output escaping of the consent_message JSON attribute inside the .qlwapp data-box. Authenticated attackers with contributor-level access or above can inject arbitrary JavaScript that executes when any visitor loads the affected page. Setting auto_open and consent_enabled to yes in the injected data-box JSON triggers the consent box, and the embedded script runs immediately on page load without further user interaction. The issue is tracked as [CWE-79] and was fixed in version 8.6.3.

Critical Impact
Stored XSS executes attacker-controlled JavaScript in every visitor's browser session on injected pages, enabling session theft, credential harvesting, and administrator account takeover.

Affected Products

Social Chat – Click To Chat App Button plugin for WordPress, all versions through 8.6.2
WordPress sites where contributor-level or higher accounts exist
Any public-facing page rendering the plugin's .qlwapp data-box

Discovery Timeline

2026-09-05 - CVE-2026-18404 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-18404

Vulnerability Analysis

The Social Chat plugin renders chat widget configuration through a .qlwapp data-box element on the frontend. The plugin's controller in class-frontend.php and its frontend index.js process a JSON payload that includes the consent_message attribute. The plugin fails to sanitize input before storage and does not escape output when rendering the JSON blob into the DOM. As a result, an authenticated user with content-authoring privileges can persist a payload that becomes active markup in the browser of any subsequent viewer.

The exploitation path becomes reliable because the plugin's own runtime logic triggers the malicious content. When the injected JSON sets auto_open and consent_enabled to yes, the consent box is rendered and displayed on page load, and any script embedded in consent_message executes in that context. No visitor click or interaction is required beyond loading the page.

Root Cause

The root cause is missing input sanitization on write and missing output escaping on render for the consent_message field of the data-box JSON. The affected code paths are visible in the plugin's frontend JavaScript and PHP controller. The plugin trusts contributor-supplied JSON attributes and injects them directly into the rendered page.

Attack Vector

The attack requires network access and authenticated contributor-level privileges. The attacker creates or edits a post that embeds a crafted .qlwapp data-box with malicious consent_message content and the auto-open flags enabled. When an administrator, editor, or site visitor loads the resulting page, the injected script executes in their browser under the site's origin. The scope is changed because the script runs in the trusted origin of the WordPress site and can affect higher-privileged users.

See the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-18404

Indicators of Compromise

Post or page content containing .qlwapp data-box markup with a consent_message value that includes HTML tags, event handlers, or <script> fragments.
Data-box JSON with auto_open and consent_enabled both set to yes on posts authored by low-privilege users.
Unexpected outbound requests from visitor browsers to attacker-controlled domains following visits to plugin-enabled pages.

Detection Strategies

Query the wp_posts table for post content containing the string qlwapp combined with consent_message and inspect any authored by contributors.
Review web server access logs for administrator sessions loading contributor-authored pages, correlated with outbound requests to unfamiliar domains.
Use a Content Security Policy (CSP) reporting endpoint to surface inline script violations originating from plugin-rendered pages.

Monitoring Recommendations

Monitor WordPress audit logs for post edits by contributor accounts that add plugin shortcodes or data-box markup.
Alert on new or modified administrator accounts created shortly after contributor content publication.
Track plugin version inventory and flag any site still running wp-whatsapp-chat at version 8.6.2 or earlier.

How to Mitigate CVE-2026-18404

Immediate Actions Required

Update the Social Chat – Click To Chat App Button plugin to version 8.6.3 or later on every WordPress site in the estate.
Audit all contributor, author, and editor accounts and remove those that are inactive or unnecessary.
Review recently authored posts for .qlwapp markup and remove any suspicious consent_message values.

Patch Information

The vendor addressed the vulnerability in version 8.6.3. The relevant fix is visible in the WordPress Plugin Changeset 8.6.2 to 8.6.3. Site administrators should apply the update through the WordPress plugin manager or WP-CLI.

Workarounds

Temporarily deactivate the Social Chat plugin until the patched version is installed.
Restrict contributor account creation and reduce untrusted user privileges to subscriber level.
Deploy a web application firewall (WAF) rule that blocks requests containing qlwapp data-box payloads with script content or event handler attributes.
Enforce a strict Content Security Policy that disallows inline scripts on public pages.

bash

# Update the plugin using WP-CLI
wp plugin update wp-whatsapp-chat --version=8.6.3

# Verify installed version
wp plugin get wp-whatsapp-chat --field=version

# List users at contributor level or above for review
wp user list --role=contributor --fields=ID,user_login,user_email,user_registered