Live › vulnerability › CVE-2026-92997
Go to dashboardThe Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 uses an unvalidated parameter as a SQL column name. An unauthenticated attacker can inject SQL and read or change the site database.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Check the installed plugin version in WordPress admin under Plugins, or run: wp plugin get click-n-chat --field=version
Update the Click n Chat plugin to 1.1.3 or later.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not properly validate a parameter before using it as a column identifier in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks.
This page as .md · .json · in your agent: get_signal("CVE-2026-92997")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.