CVE-2026-7795 describes a stored cross-site scripting vulnerability in the Click to Chat – WA Widget WordPress plugin by HoliThemes, affecting all versions up to and including 4.38. The vulnerability arises from improper neutralization of input in the 'num' shortcode parameter. The plugin applies esc_attr() to the 'num' parameter, converting single quotes to the HTML entity ', but this entity is decoded back to a literal single quote by browsers when the value is placed inside a JavaScript window.open() call within an HTML onclick attribute. This decoding allows an attacker to break out of the JavaScript string context and execute arbitrary code. Exploitation requires authenticated access at Contributor level or above, enabling injection of malicious scripts that execute upon user interaction with the WhatsApp chat button rendered by the shortcode.

An attacker with Contributor-level or higher privileges can inject arbitrary JavaScript code that executes in the context of users who click the WhatsApp chat button on affected sites. This can lead to information disclosure or other client-side impacts. The vulnerability does not allow unauthenticated exploitation and does not impact availability.

No official patch or fix is currently confirmed for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level access to trusted users only and consider disabling or removing the Click to Chat plugin if possible to prevent exploitation.