CVE-2026-18964: WordPress Chaty Plugin XSS Vulnerability

CVE-2026-18964 Overview

CVE-2026-18964 is a Reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting the Chaty plugin for WordPress. The plugin, marketed as the Floating Chat Widget with Telegram, Line, WeChat, Email, SMS, and Call Button integrations, fails to sanitize the s search parameter before embedding it into a dynamically constructed HTML attribute. All versions up to and including 3.5.9 are affected. Unauthenticated attackers can inject arbitrary JavaScript that executes when a victim clicks a crafted link.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in a victim's browser session, enabling session theft, credential harvesting, and administrative account takeover on affected WordPress sites.

Affected Products

Chaty plugin for WordPress (Floating Chat Widget)
All versions up to and including 3.5.9
WordPress sites using the cht-front-script.min.js frontend script

Discovery Timeline

2026-09-11 - CVE-2026-18964 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-18964

Vulnerability Analysis

The vulnerability originates in the Chaty plugin's frontend JavaScript (cht-front-script.min.js). WordPress server-side rendering HTML-encodes the s search parameter when placing it inside the <title> element. This encoding is normally sufficient to prevent injection. However, the Chaty script reads the page title client-side using jQuery's .text() method against document.title.

When the browser's DOM API exposes document.title, it automatically decodes HTML entities and returns literal special characters. The Chaty script then concatenates this decoded string directly into an HTML attribute value without re-escaping. Attackers craft URLs where the s parameter contains attribute-breaking characters and script payloads that execute upon DOM insertion.

Root Cause

The root cause is inconsistent trust in encoding boundaries. Server-side output escaping is bypassed because the DOM decodes entities before the client-side code consumes the value. The plugin assumes document.title returns a safe string, then uses string concatenation to build markup instead of using safe DOM methods such as setAttribute or textContent-based assembly.

Attack Vector

Exploitation requires user interaction. An attacker crafts a URL to a vulnerable WordPress site with a malicious s query parameter containing JavaScript. The victim must click the link. When the page loads, WordPress HTML-encodes the value into the <title> tag, the browser decodes it into document.title, and the Chaty script embeds the raw characters into an attribute, breaking out of the attribute context and executing the payload in the victim's browser under the site's origin.

Refer to the Wordfence Vulnerability Analysis and the WordPress Chaty Changeset for the corrective code changes.

Detection Methods for CVE-2026-18964

Indicators of Compromise

Web server access logs containing requests with the s parameter carrying HTML entities, angle brackets, quote characters, or javascript: URIs.
Referrer headers from unexpected external domains pointing to WordPress search URLs.
Unexpected outbound requests from user browser sessions after visiting search result pages on sites running Chaty.

Detection Strategies

Inspect HTTP request logs for search queries containing payloads such as ", <, >, onerror=, or onload= within the s parameter.
Deploy a Web Application Firewall (WAF) rule that flags reflected script content in query string parameters targeting WordPress /?s= endpoints.
Enumerate WordPress installations for the Chaty plugin at version 3.5.9 or earlier using plugin inventory tooling.

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting to capture blocked inline script execution attempts.
Monitor administrator session activity for anomalous authenticated actions immediately following search page visits.
Alert on newly created administrator accounts or plugin installations that follow suspicious search-parameter traffic patterns.

How to Mitigate CVE-2026-18964

Immediate Actions Required

Update the Chaty plugin to the version published in changeset 3637386 or later, which supersedes the vulnerable cht-front-script.min.js.
If updating is not immediately possible, deactivate the Chaty plugin until the patch is applied.
Audit WordPress administrator accounts and rotate session tokens on sites that have run vulnerable Chaty versions.

Patch Information

The vendor addressed the flaw in the Chaty plugin trunk. The fix replaces the unsafe use of document.title with sanitized handling and prevents unescaped concatenation into attribute contexts. Review the WordPress Chaty Script and the WordPress Chaty Changeset for exact code changes.

Workarounds

Deploy a WAF rule that blocks requests containing HTML special characters or script tokens in the s parameter.
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Restrict administrator access to trusted networks so a stolen session cookie cannot be reused externally.

bash

# Example ModSecurity rule to block reflected XSS payloads in the WordPress search parameter
SecRule ARGS:s "@rx (?i)(<script|onerror=|onload=|javascript:|\"\s*\w+=)" \
    "id:1026189640,phase:2,deny,status:403,msg:'CVE-2026-18964 Chaty reflected XSS payload blocked'"