CVE-2026-92998 PUBLISHED

Click n Chat 1.0.4 - 1.1.2 - Unauthenticated SQLi via 'sort_by'/'sort_order' Parameters

Assigner: WPScan
Reserved: 17.09.2026 Published: 21.10.2026 Updated: 21.10.2026

The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not sanitise sort parameters before using them in a SQL ORDER BY clause, allowing unauthenticated attackers to perform SQL injection attacks.

Product Status

Vendor Unknown
Product Click n Chat (Chat Widget Integration)
Versions Default: unaffected
  • affected from 1.0.4 to 1.1.3 (excl.)

Credits

  • Erwan LR (WPScan) finder
  • WPScan coordinator

References

Problem Types

  • CWE-89 SQL Injection CWE