CVE-2026-15759

Name of the Vulnerable Software and Affected Versions ChatHelp – Click to Chat Button, WooCommerce Chat to Order & Floating Chat Form versions prior to 3.5.2

Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. This is achieved by injecting arbitrary web scripts through the number and group shortcode attributes, which execute when a user visits the affected page.

Recommendations Update to version 3.5.2 or later.