{"id":"CVE-2026-92097","revision":"610ec54435d747f08c0d9b572152dc02","records":[{"revision":"610ec54435d747f08c0d9b572152dc02","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-92097","aliases":[],"title":"Click to Chat <= 4.44 - Unauthenticated Arbitrary Shortcode Execution via REQUEST_URI via {url} Placeholder","description":"The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.44 This is due to the greetings_dialog() function building the {url} template placeholder from a sanitize_text_field()-filtered $_SERVER['REQUEST_URI'] on archive pages and then passing the substituted greeting content to do_shortcode() in the greetings-1 and greetings-2 templates, without stripping shortcode delimiters. Because wp_kses() runs against main_content BEFORE the {url} substitution, the attacker-controlled URL bytes reach do_shortcode() unfiltered. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes registered by WordPress core, the active theme, or any other plugin (e.","state":0,"publishedAt":"2026-10-14T01:27:15.838+00:00","modifiedAt":"2026-10-15T16:43:51.033+00:00","affected":[{"ecosystem":"Vendor product","name":"Click to Chat – HoliThemes","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"holithemes\",\n                    \"product\": \"Click to Chat – HoliThemes\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"status\": \"affected\",\n                            \"lessThanOrEqual\": \"4.44\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","score":9.1,"severity":"CRITICAL"}],"references":["https://www.wordfence.com/threat-intel/vulnerabilities/id/cf625e34-1f51-42a3-8daa-a5188dea226e?source=cve","https://plugins.trac.wordpress.org/browser/click-to-chat-for-whatsapp/tags/4.44/new/inc/greetings/greetings-1.php#L22","https://plugins.trac.wordpress.org/browser/click-to-chat-for-whatsapp/tags/4.44/new/inc/greetings/greetings-2.php#L18","https://plugins.trac.wordpress.org/browser/click-to-chat-for-whatsapp/tags/4.44/new/inc/greetings/class-ht-ctc-chat-greetings.php#L111","https://plugins.trac.wordpress.org/browser/click-to-chat-for-whatsapp/tags/4.44/new/inc/greetings/class-ht-ctc-chat-greetings.php#L224","https://plugins.trac.wordpress.org/changeset/3716433/click-to-chat-for-whatsapp/trunk/new/inc/greetings/greetings-1.php"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-92097","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-92097","identifiers":["CVE-2026-92097"]},"retained":false,"historicalAffected":[]}],"coverage":[]}