Advisories · Technology
Click to Chat – HoliThemes.
Every CVE that names Click to Chat – HoliThemes among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 9.1 CriticalCritical · CVSS 9+
Click to Chat <= 4.44 - Unauthenticated Arbitrary Shortcode Execution via REQUEST_URI via {url} Placeholder
- Click to Chat – HoliThemes
- Code injection
- CVSS 6.4 Medium
Click to Chat <= 4.39 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'num' Shortcode Parameter
- Click to Chat – HoliThemes
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Click to Chat <= 4.22 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via data-no_number Parameter
- Click to Chat – HoliThemes
- Cross-site scripting (XSS)
- CVSS 8.8 High
Click to Chat – HoliThemes <= 3.35 - Authenticated (Contributor+) Local File Inclusion
- Click to Chat – HoliThemes
- File inclusion