CVE-2026-92097: CWE-94 Improper Control of Generation of Code ('Code Injection') in holithemes Click to Chat – HoliThemes

CVE-2026-92097 is a critical code injection vulnerability in the Click to Chat for WhatsApp WordPress plugin by HoliThemes, affecting versions up to 4.44. The issue stems from the greetings_dialog() function, which constructs the {url} placeholder from a sanitize_text_field()-filtered $_SERVER['REQUEST_URI'] on archive pages. This placeholder is then passed to do_shortcode() within greeting templates without removing shortcode delimiters. Since wp_kses() sanitization occurs before the {url} substitution, the attacker-controlled URL content is not properly filtered before shortcode execution. This allows unauthenticated attackers to execute arbitrary shortcodes registered by WordPress core, active themes, or other plugins, potentially leading to high-impact code injection.

An unauthenticated attacker can exploit this vulnerability to execute arbitrary shortcodes within the WordPress environment. This can lead to full compromise of the affected site’s content rendering and potentially escalate to further attacks depending on the capabilities of the executed shortcodes. The CVSS v3.1 score is 9.1 (critical), reflecting the vulnerability's network attack vector, low complexity, no privileges required, no user interaction, and high confidentiality and integrity impact.

Patch status is not yet confirmed — no official fix or patch links are provided in the available data. Users should monitor the vendor's advisory for updates and apply any official patches once released. Until a patch is available, consider disabling or removing the Click to Chat plugin if feasible, or restrict access to archive pages to trusted users only. Avoid exposing the vulnerable functionality to untrusted inputs. Do not rely on generic mitigations; wait for vendor guidance.