CVE-2026-92097 Details
Description
The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.44 This is due to the greetings_dialog() function building the {url} template placeholder from a sanitize_text_field()-filtered $_SERVER['REQUEST_URI'] on archive pages and then passing the substituted greeting content to do_shortcode() in the greetings-1 and greetings-2 templates, without stripping shortcode delimiters. Because wp_kses() runs against main_content BEFORE the {url} substitution, the attacker-controlled URL bytes reach do_shortcode() unfiltered. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes registered by WordPress core, the active theme, or any other plugin (e.
A vulnerability allowing arbitrary shortcode execution has been identified in the Click to Chat for WhatsApp plugin for WordPress, affecting versions through 4.44. The issue arises in the greetings_dialog() function, which constructs the {url} template placeholder using a sanitize_text_field()-filtered $_SERVER['REQUEST_URI'] on archive pages. This substituted greeting content is then passed to do_shortcode() in the greetings-1 and greetings-2 templates without removing shortcode delimiters. As a result, unfiltered, attacker-controlled URL bytes can reach do_shortcode(), enabling unauthenticated attackers to execute arbitrary shortcodes registered by WordPress core, the active theme, or other plugins.
Users are advised to update the Click to Chat for WhatsApp WordPress plugin to version 4.45 or a newer patched version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| HoliThemes Click to Chat | <= 4.44 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |