CVE-2026-18404: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in quadlayers Social Chat – Click To Chat App Button

CVE-2026-18404 describes a stored cross-site scripting vulnerability in the Social Chat – Click To Chat App Button plugin for WordPress. The flaw exists due to insufficient sanitization and escaping of the 'consent_message' JSON attribute inside the .qlwapp data-box. Authenticated attackers with contributor or higher privileges can inject arbitrary JavaScript that executes immediately upon page load by setting 'auto_open' and 'consent_enabled' to 'yes' in the injected JSON data-box. This vulnerability affects all plugin versions up to and including 8.6.2.

An attacker with contributor-level access or higher can inject persistent malicious scripts that execute automatically when any user views the affected page. This can lead to information disclosure and integrity impacts as indicated by the CVSS vector (Confidentiality and Integrity impacts are low, Availability is not affected). No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and monitor for suspicious activity related to the plugin's data-box JSON attributes. Avoid enabling 'auto_open' and 'consent_enabled' settings unless necessary and verified safe.