PT-2026-120485

CVE-2026-92997

Published

2026-10-21

Updated

2026-10-21

Description by

CVSS 3.1

8.6

High

MetricsAV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Click n Chat (Chat Widget Integration) WordPress plugin versions prior to 1.1.3

Description An issue exists where the software fails to properly validate a parameter before utilizing it as a column identifier within a SQL query. This allows unauthenticated attackers to execute SQL injection attacks, a technique where malicious SQL statements are inserted into entry fields for execution. The vulnerable parameter is datacolumn.

Recommendations Update the Click n Chat (Chat Widget Integration) WordPress plugin to version 1.1.3 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Ryan Fabella

Vendors

Affected products

Weakness enumeration

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')

Related identifiers