CVE-2026-7795: Click to Chat WA Widget XSS Vulnerability

CVE-2026-7795 Overview

CVE-2026-7795 is a Stored Cross-Site Scripting (XSS) vulnerability in the Click to Chat – WA Widget plugin for WordPress, affecting all versions up to and including 4.38. The flaw resides in the [chat] shortcode's num parameter, where insufficient escaping allows authenticated attackers with Contributor-level access or higher to inject arbitrary JavaScript. The malicious payload executes whenever a visitor clicks the rendered WhatsApp chat button. The vulnerability is categorized under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Authenticated Contributor-level attackers can inject persistent JavaScript that executes in the browsers of site visitors, enabling session theft, account takeover, and arbitrary action execution within the WordPress site context.

Affected Products

Click to Chat – WA Widget plugin for WordPress (all versions through 4.38)
WordPress sites running the click-to-chat-for-whatsapp plugin with the [chat] shortcode rendered
Style template sc-style-1.php and related shortcode style files

Discovery Timeline

2026-06-06 - CVE-2026-7795 published to NVD
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2026-7795

Vulnerability Analysis

The vulnerability stems from improper sanitization of shortcode attribute values that flow through multiple encoding contexts. The CCW_Shortcode::shortcode() function in class-ccw-shortcode.php applies esc_attr() to the num parameter at line 157. While esc_attr() is appropriate for HTML attribute escaping, it produces output unsuitable for JavaScript string literal contexts.

The escaped value is interpolated into a JavaScript window.open() call delimited by single quotes at line 194/221. The resulting string is then placed verbatim into an HTML onclick event-handler attribute in style template files such as sc-style-1.php. This nested context confusion creates the injection point.

Root Cause

The root cause is a context mismatch between esc_attr() output and the JavaScript string literal sink. esc_attr() converts single quotes to the HTML entity ', which is safe in pure HTML attribute contexts. However, browsers HTML-decode event-handler attribute values before executing the embedded JavaScript. At runtime, ' is decoded back to literal single quotes, breaking out of the JavaScript string and enabling arbitrary script execution.

Attack Vector

An authenticated attacker with Contributor permissions or higher creates or edits a post containing the [chat] shortcode with a malicious num attribute. The payload uses HTML-entity-encoded single quotes to terminate the JavaScript string in window.open(), then appends arbitrary JavaScript. When any visitor clicks the rendered WhatsApp chat button, the injected code executes in their browser session.

The vulnerability mechanism is described in detail in the Wordfence Vulnerability Analysis and visible in the vulnerable shortcode handler source.

Detection Methods for CVE-2026-7795

Indicators of Compromise

Post or page content containing [chat] shortcodes with num attribute values that include HTML entities such as ' followed by JavaScript syntax tokens.
Rendered pages containing onclick handlers where the window.open() argument breaks out of its expected numeric or phone-number format.
Unexpected outbound requests from visitor browsers to attacker-controlled domains originating from pages containing the [chat] shortcode.

Detection Strategies

Audit the WordPress wp_posts table for shortcode invocations matching the pattern [chat ... num="...'..."] or similar entity-encoded quote sequences.
Inspect rendered HTML output for onclick attributes containing JavaScript payloads beyond the expected window.open('https://wa.me/...') structure.
Review web server access logs for POST requests to wp-admin/post.php or the REST API from Contributor-level accounts modifying posts that contain the [chat] shortcode.

Monitoring Recommendations

Monitor WordPress audit logs for shortcode edits performed by low-privilege roles, particularly Contributors and Authors.
Deploy a Content Security Policy (CSP) that restricts inline script execution to limit the impact of stored XSS payloads.
Alert on creation or modification of posts containing suspicious shortcode parameter patterns through a Web Application Firewall (WAF) rule set.

How to Mitigate CVE-2026-7795

Immediate Actions Required

Update the Click to Chat – WA Widget plugin to a version newer than 4.38 once a patched release is available.
Audit all existing posts, pages, and custom post types for [chat] shortcode usage and remove any suspicious num parameter values.
Restrict Contributor and higher role assignments to trusted users only, and review recent role grants.

Patch Information

Review the plugin repository for fix commits via the WordPress plugin changeset. At publication time, version 4.39 source in the plugin repository still contains the vulnerable code paths at the same line references. Verify the installed version includes proper context-aware escaping such as esc_js() or wp_json_encode() for JavaScript string contexts before considering the system patched.

Workarounds

Temporarily deactivate the Click to Chat – WA Widget plugin until a verified patch is installed.
Remove the [chat] shortcode from all published content and replace with a static link if WhatsApp contact functionality is required.
Apply a WAF rule that blocks POST requests containing [chat combined with HTML entity sequences such as ' or ' in the num attribute.
Restrict post-editing capabilities to Editor and Administrator roles by removing publishing rights from Contributors via a role management plugin.

bash

# Example: WP-CLI command to deactivate the vulnerable plugin
wp plugin deactivate click-to-chat-for-whatsapp

# Example: Audit posts for suspicious shortcode usage
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%[chat%num=%'%'"