Live › vulnerability › CVE-2026-92998
Go to dashboardThe Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 passes sort parameters into a SQL ORDER BY clause without sanitising them. An unauthenticated attacker can inject SQL to read or change the site's database.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Check the installed plugin version in wp-admin under Plugins, or run: wp plugin get click-n-chat --field=version (unknown if the slug differs).
Update the Click n Chat plugin to version 1.1.3 or later.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not sanitise sort parameters before using them in a SQL ORDER BY clause, allowing unauthenticated attackers to perform SQL injection attacks.
This page as .md · .json · in your agent: get_signal("CVE-2026-92998")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.